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B2.2.AArch64 architectural system register SUMIMALY ........ccc seein cents eteneeetnneeenenee B2-287 
B2.3_  AArch64 implementation defined register SUMMALY wu... .eiec cites ceeteeetteeenennees B2-294 
B2:4 —AAKchO4 registers Dy TUNCUON Al QNOUP x25 cssavcesaecseass es t2caeedi ae cnctiaasioee eRe ee aos B2-296 
B25. -ACTER ELT, Auxiliaty Control ReGislencEl] sissctsccpecteesasieies vaca enecannatieiadin B2-304 
B26 (“ACTER ELD Auxiliary Control Register Eb? vic ccisscaasesiiedeas daetaeaiademmcouaionvedesd B2-305 
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B2.7  ACTLR_EL3, Auxiliary Control Register, EL 0.......:cccsscccccceses ceeesneecesseeseseeseeees B2-307 
B2.8 AFSRO_EL1, Auxiliary Fault Status Register 0, EL... ceesccessee ceeeeseeeeeteeeenes B2-309 
B2.9 AFSRO_EL2, Auxiliary Fault Status Register 0, EL2 .....ceeeeeseeceeeeteeeeeneenenee B2-310 
B2.10 AFSRO_EL3, Auxiliary Fault Status Register 0, EL3 .0........cc:scccccee seeeeeeeeeenneeeeees B2-311 
B2.11 AFSR1_EL1, Auxiliary Fault Status Register 1, EL .0.....2..:s:ccccccceceeeeenneeeeseeeneaee B2-312 
B2.12 AFSR1_EL2, Auxiliary Fault Status Register 1, EL2 ..........:::ccccccccceeseesnneeeeeenene B2-313 
B2.13 AFSR1_EL3, Auxiliary Fault Status Register 1, EL3 .0........:s:scccccccceeseesneneeeeeeneaee B2-314 
B2t4 AIDR ELT. Auxiliary ID: ROGISt@R EET ciiectessn ohetacer iis aieeaseianiere ieee teehee B2-315 
B2.15 AMAIR_EL1, Auxiliary Memory Attribute Indirection Register, EL1 ........0.:. B2-316 
B2.16 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register, EL2 .............0 B2-317 
B2.17  AMAIR_EL3, Auxiliary Memory Attribute Indirection Register, EL3 ........0...:00 B2-318 
B2.18 ATCR_EL1, Auxiliary Translation Control Register, EL... cscceee cceeeteeeeneees B2-319 
B2.19 ATCR_EL172, Alias to Auxiliary Translation Control Register EL1 00.0... B2-321 
B2.20 ATCR_EL2, Auxiliary Translation Control Register, EL2 
B2.21 ATCR_EL3, Auxiliary Translation Control Register, EL3 
B2.22 AVTCR_EL2, Auxiliary Virtualized Translation Control Register, EL2 ................ B2-326 
B2:23 CCSIDR_EL1, Cache Size ID ROGISIOR BLT scciewcciesiiessserstinesen tcconvavcevescseesseuaeees B2-328 
B2:24 CLIDR_ ELT, Cache Level ID: ROGISICN, ELT sciscssicssscccsvisrescsesvevoessesteveevseesvusesviee B2-331 
B2.25 CPACR_EL1, Architectural Feature Access Control Register, EL ..........:e B2-333 
B2.26 CPTR_EL2, Architectural Feature Trap Register, EL2 ...20.:.:sscrcsconce-cccseocoesecenssee B2-334 
B2.27 CPTR_EL3, Architectural Feature Trap Register, ELS ...s:cccisccccesecssecssevssesecneseone B2-335 
B2.28 CPUACTLR_EL1, CPU Auxiliary Control Register, ELT w.seciccseccccsenvesesonsseerensens B2-336 
B2.29'° CPUCER EL, CPU Contiguration ReGISICG ELT essccsscccesenesriscsvcsdesxindsveassannaceass B2-338 
B2.30 CPUECTLR_EL1, CPU Extended Control! Register, ELT ceicscccsecsoncs coxscoosscreseces B2-340 
B2.37 GPUPGR_EL3, CPU Private Conitro] Register, EL3 swsisssssccsesisasseasondeienassendaacpedscs B2-343 
B2.32 CPUPMR_EL3, CPU Private Mask ReGISIGl, ELS issicccsecccccie-scsseniaaaietaeietdessanetcoss B2-345 
B2.33 GPUPOR_EL3, CPU Private Operation Register, BLS s.c:ccsocsssescseeuhtssosaseatcetanses B2-347 
B2.34 CPUPSELR_EL3, CPU Private Selection Register, EL3 .........:::ccccccsccceeeeseseees B2-349 
B2.35. CPUPWREITLR.EL7,.Power Gontrol ReGISI@G ELT. siccc.sasesckarieseaentestoeiecetasiteds B2-351 
B2.36 CSSELR_EL1, Cache Size Selection Register, EL ..........:::::ccccc ceseerseeesseeneeee B2-354 
B237 CRROELG Cache Type Register EO ssz:carsisscdessteciaebes thave cendeathcoactebsies dean tateaaes B2-355 
B2.38 DCZID_ELO, Data Cache Zero ID Register, ELO ........1.:ccccccsessce cessesseeeeeseesneaneees B2-357 
B2.39 DISR_EL1, Deferred Interrupt Status Register, EL ..cccicieicccceccescctceeetcersececenes B2-358 
B2:40 ERRIDR_EL1, Error ID Register, ELT wssxcicsscscescceiccceeietere ottcaevaeese tet ceeecdecateeees B2-360 
B2.41 ERRSELR_EL1, Error Record Select Register, EL .........::::ccccccssssecssenensneneeees B2-361 
B2.42 ERXADDR_EL1, Selected Error Record Address Register, EL1 .......c cece B2-362 
B2.43. ERXCTLR_EL1, Selected Error Record Control Register, EL .......cccesceees B2-363 
B2.44 ERXFR_EL1, Selected Error Record Feature Register, EL ......1.::cccsscsosessseenes B2-364 
B2.45 ERXMISCO_EL1, Selected Error Record Miscellaneous Register 0, EL7 .......... B2-365 
B2.46 ERXMISC1_EL1, Selected Error Record Miscellaneous Register 1, EL7 .......... B2-366 
B2.47 ERXPFGCDNR_EL1, Selected Error Pseudo Fault Generation Count Down Register, 

| By cre eee ree Cree rere oer Perera rere eer cr eee rere tr errr ert crete B2-367 
B2.48 ERXPFGCTLR_EL1, Selected Error Pseudo Fault Generation Control Register, EL1 ... 

ee Tai eae go GE SO a Pale AES SE nen eee B2-369 
B2.49 ERXPFGFR_EL1, Selected Pseudo Fault Generation Feature Register, EL1.. B2-371 
B2.50 ERXSTATUS_EL1, Selected Error Record Primary Status Register, EL7.......... B2-372 
B2:o7 (ESR ELM. Exception Syndrome REGIStC ELT. ssscxssscescecentsacacuse stenceacvdseencsbeeceaes B2-373 
B2:62: ESR EL2 Exception Syndrome R6GIStel, ELD: ssccsvsssecshecctesscacisn sceebstedesdeasseresezars B2-374 
B2.53 ESR_EL3. Exception Syndrome: R6GIStCl, ELS |. .cccccsessscencesescsneargoeentsvetters¥iensvees B2-375 
B2.54 HACR_EL2, Hyp Auxiliary Configuration Register, EL2 0... eeeeceeeeesseeeeneees B2-376 
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B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 wo... ..ee ccc eeeeeeeeneeeeeneeene B2-377 
B2.56 HPFAR_EL2, Hypervisor IPA Fault Address Register, EL2 .......0 ccc cieeeneees B2-379 
B2.57 ID_AA64DFRO_EL1, AArch64 Debug Feature Register 0, EL ou... cece B2-380 
B2.58 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute Register 0, EL7.......... B2-382 
B2.59 ID_AA64ISAR1_EL1, AArch64 Instruction Set Attribute Register 1, EL7.......... B2-384 
B2.60 ID_AA64MMFRO_EL1, AArch64 Memory Model Feature Register 0, EL7........ B2-385 
B2.61 ID_AA64MMFR1_EL1, AArch64 Memory Model Feature Register 1, EL7........ B2-387 
B2.62 ID_AA64MMFR2_EL1, AArch64 Memory Model Feature Register 2, EL7........ B2-389 
B2.63 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 0, EL1 ou... ccc B2-390 
B2.64 ID_AA64PFR1_EL1, AArch64 Processor Feature Register 1, EL ...... ccc B2-392 
B2.65 ID_AFRO_EL1, AArch32 Auxiliary Feature Register 0, EL w...ceeeceee ceeeteeeenees B2-393 
B2.66 ID_DFRO_EL1, AArch32 Debug Feature Register 0, EL1 w.....eeeeeceesseeeeeneeees B2-394 
B2.67 ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, EL1 uu... B2-396 
B2.68 ID_ISAR1_EL1, AArch32 Instruction Set Attribute Register 1, EL1 ue B2-398 
B2.69 ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 2, EL1 ue B2-400 
B2.70 ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, EL1 wee B2-402 
B2.71_ ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4, EL1 ........ceee B2-404 
B2.72 ID_ISAR5_EL1, AArch32 Instruction Set Attribute Register 5, EL1 ..........c eee B2-406 
B2.73. ID_ISAR6_EL1, AArch32 Instruction Set Attribute Register 6, EL1 .........eeee B2-408 
B2.74. ID_MMFRO_EL1, AArch32 Memory Model Feature Register 0, EL1 uu... B2-409 
B2.75 ID_MMFR1_EL1, AArch32 Memory Model Feature Register 1, EL1 ........c eee B2-411 
B2.76 ID_MMFR2_EL1, AArch32 Memory Model Feature Register 2, EL1 ......ccee B2-413 
B2.77 ID_MMFR3_EL1, AArch32 Memory Model Feature Register 3, EL1 .......0e B2-415 
B2.78 ID_MMFR4_EL1, AArch32 Memory Model Feature Register 4, EL1 .......e B2-417 
B2.79 ID_PFRO_EL1, AArch32 Processor Feature Register 0, EL .......cccecceeeeeneee B2-419 
B2.80 ID_PFR1_EL1, AArch32 Processor Feature Register 1, EL1 .......ccceccesseeneeee B2-421 
B2.81 ID_PFR2_EL1, AArch32 Processor Feature Register 2, ELT .iciseccccsccnnssosszeeecene B2-423 
B2.82 IFSR32_EL2, Instruction Fault Status Register, EL2 .00.........1.:s:cccccessceseseeenenneees B2-424 
B283' ORG ELI. LORegion Control Register ELT s2z scsi tieasstectotenteetieehienieseRed B2-426 
B2.84 LOREA_EL1, LORegion End Address Register, EL1 .....c ccc ceceneeteeteeeeee B2-427 
B2.85 LORID_EL1, Limited Order Region Identification Register, EL w.......1c. cece B2-428 
B2:86 LORN_EL1, LORegion Number Register, ELT o.scccsscccccsecsseetecne cnsecsiesocnsoasterseeont B2-429 
B2.87 LORSA_EL1, LORegion Start Address Register, EL 0... cesses ceeseeesnteeenees B2-430 
B2.88 MDCR_EL3, Monitor Debug Configuration Register, EL3 .......e ccs ceseceeeeees B2-431 
B2:89°. MIDR_EL1, ‘Main ID R6GISter, BLT scscsscicsceecapeeossecteanede det toeocebestibeswes levenc ate ayveceiee B2-433 
B2.90 MPIDR_EL1, Multiprocessor Affinity Register, EL ........cccccceecesnteeeneeeeeeneeees B2-434 
B2O7 “PAR ELT, Physical Address Register (BEY. nasasissaciwncsaisitiacs iaiaaioueateeiede B2-436 
B2Z92 (REVIDROELT, REVISION IDAREGGISIOl ELD ssiectaseuassiadsuetianaesatiaismndeadnnnntaiede B2-437 
B2.93 RVBAR_EL3, Reset Vector Base Address Register, EL3 ...... ccc ceerseeenees B2-438 
B294 -SCTER ELT, System Control REGIStOG ELT cass. sbcessasiiadteeseadecanstoaneresaceenseund B2-439 
B2:95 SCTERLEL2. System Control REGIStOl, BL xcs sevens scsssecavissd <vencensuiueasseiearmcrts B2-440 
B2-96 SCTER_ ELS, System Control REGISICl, ELS scccccecsecaressteceneska svaterdhe eeu ete cetmerbe B2-441 
B2.97 -“ TCR ELT. translation Control Register, BIT cevcsicccecteceiascecesscapvarachiseeiabinasaaavaass B2-442 
B298 TCR:EL2. Translation Control REGIStCl BL? ss sosscscziseavaicetette tap rixstisieianapansiatana B2-444 
B2:99'° TCRIELS: translation Gontrol IRCGISIGR ELS i oscssisaitseussdsadeaelesdaidasds datas daateeateniesne B2-448 
B2.100 TTBRO_EL1, Translation Table Base Register 0, EL .0.......2:::s:ccccssseeeeesestesneees B2-450 
B2.101 TTBRO_EL2, Translation Table Base Register 0, EL2 ..........:c:s:cccccssscenessesnenneees B2-451 
B2.102 TTBRO_EL3, Translation Table Base Register 0, EL3 u0........::::cccccsseeeceeseenenneees B2-452 
B2.103 TTBR1_EL1, Translation Table Base Register 1, EL ..........:::::ccccccsseesseesesseneeees B2-453 
B2.104 TTBR1_EL2, Translation Table Base Register 1, EL2 ..........1::s:cccccssseensessesnesneees B2-454 
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B2.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 ........cce cee B2-455 





B2.106 VMPIDR_EL2, Virtualization Multiprocessor ID Register, EL2 00... eee B2-458 
B2.107 VPIDR_EL2, Virtualization Processor ID Register, EL2 0.0... ccecceneeeeenteeeeeee B2-459 
B2.108 VSESR_EL2, Virtual SError Exception Syndrome Register .........::cc6. cesses B2-460 
B2.109 VTCR_EL2, Virtualization Translation Control Register, EL2 w......ecccceeeeeees B2-462 
B2.110 VTTBR_EL2, Virtualization Translation Table Base Register, EL2 .....00... cece B2-463 
Chapter B3 Error system registers 
Bost’ “Emer Systeninegister SUMNM ANY wcssenccets cotatesehes charsibce sales aebiescheosciteaabeni theirs B3-466 
B3.2 ERROADDR, Error Record Address ReQjster .........12:::ccccccccsce: sececeessesneneeneesnenee B3-468 
B33 ERROCTLR:. Error Record Control RGISUGM s.sissssaisestssseaastxeesiesssatcntvesdudechaveaeeanes B3-469 
B3:4  ~ERROFR, Error Record Feature: ROGISICM .icicniccsciccesecsiaiie ties ribecsedeivieoneeeneeseess B3-471 
B3.5 ERROMISCO, Error Record Miscellaneous Register 0 o.......ccccccceeeneeceenteeenes B3-473 
B3.6 ERROMISC1, Error Record Miscellaneous ReQister 1 o......:ccceececeeeneeeeeneeene B3-475 
B3.7 > ERROPFGCDNR, Error Pseudo Fault Generation Count Down Register ..... ..... B3-476 
B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control Register ...........:cc008 B3-477 
B3.9 ERROPFGFR, Error Pseudo Fault Generation Feature Register ..........::::::::0000 B3-479 
B3.10 ERROSTATUS, Error Record Primary Status R@QiSter .....:ccc00:cc000 sisceceoossveeeeess B3-481 
Chapter B4 GIC registers 
B4.1 ‘CPU Intelace FOGISlOTS .i.c3caccasieszecteccteczescutac A caeiols ctbss saeastaesh peadtweeskeesdeAeasaeseens B4-487 
B4.2.— AArch32 physical GIC CPU interface system register SUMIMALY .........660 ceeeeeeee B4-488 
B4.3. ICC_APORO, Interrupt Controller Active Priorities Group O Register 0....... ....... B4-489 
B4.4  ICC_AP1R0, Interrupt Controller Active Priorities Group 1 Register 0 ....... 0.0... B4-490 
B4.5 ICC_BPRO, Interrupt Controller Binary Point Register 0 .......:c ccc ceseesseeeenees B4-491 
B4.6  ICC_BPR7, Interrupt Controller Binary Point Register 1 .0.....:ccccccce ceceeeseeeenees B4-492 
B4.7 ICC_CTLR, Interrupt Controller Control REGIStCP si.ccciseissscnesesssvensseaserriecsereseredoes B4-493 
B4.8 ICC_HSRE, Interrupt Controller Hyp System Register Enable Register............ B4-495 
B4.9 ICC_MCTLR, Interrupt Controller Monitor Control ReQiSter ........:ccccseeeeeees B4-497 
B4.10 ICC_MSRE, Interrupt Controller Monitor System Register Enable Register ...... B4-499 
B4.11. ICC_SRE, Interrupt Controller System Register Enable Register ........... 00+ B4-501 
B4.12 AArch32 virtual GIC CPU interface register SUMMALY oo. ..eeeeec cite ceteetnteeteneeees B4-503 
B4.13_ ICV_APORO, Interrupt Controller Virtual Active Priorities Group O Register 0 .... B4-504 
B4.14_ ICV_AP1RQO, Interrupt Controller Virtual Active Priorities Group 1 Register 0 .... B4-505 
B4.15 ICV_BPRO, Interrupt Controller Virtual Binary Point Register 0 .0......cccceeeeeee B4-506 
B4.16 ICV_BPR71, Interrupt Controller Virtual Binary Point Register 1 ......... cesses B4-507 
B4.17 ICV_CTLR, Interrupt Controller Virtual Control Register .........::ccccccesseeeeeeeeeee B4-508 
B4.18 AArch32 virtual interface control system register SUMIMALY ........::c cc eeteeentees B4-510 
B4.19 ICH_APORO, Interrupt Controller Hyp Active Priorities Group O Register 0........ B4-511 
B4.20 ICH_AP1RO, Interrupt Controller Hyp Active Priorities Group 1 Register 0 ........ B4-512 
B4.21 ICH_HCR, Interrupt Controller Hyp Control ReQiSter ......2:::.2:c0ccensesecsseessesenceeeee B4-513 
B4.22 ICH_VMCR, Interrupt Controller Virtual Machine Control Register .......0.. 000+ B4-516 
B4.23 ICH_VTR, Interrupt Controller VGIC Type ROQISIEP .....:.s.ccss00ccceesnensecssenssesecnesoons B4-518 
B4.24 AArch64 physical GIC CPU interface system register SUMIMALY ........1600 cee eeee B4-520 
B4.25 ICC_APORO_EL1, Interrupt Controller Active Priorities Group O Register 0, EL7.... 
Sagetatagtatenaatuenans Sentecacenesesma guest erase tncpts eseaccees ascesleca a iacaatlecsta ih faecsseactaafeinsseued fay B4-521 
B4.26 ICC_AP1R0_EL1, Interrupt Controller Active Priorities Group 1 RegisterO EL1 B4-522 
B4.27 ICC_BPRO_EL1, Interrupt Controller Binary Point Register 0, EL ...... cee B4-523 
B4.28 ICC_BPR1_EL1, Interrupt Controller Binary Point Register 1, EL1 ...... cc B4-524 
B4.29 ICC_CTLR_EL1, Interrupt Controller Control Register, EL ....cccee ceceeeeeees B4-525 
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B4.30 ICC_CTLR_EL3, Interrupt Controller Control Register, EL3 u....0cce ceeeeeeeeeee B4-527 
B4.31 ICC_SRE_EL1, Interrupt Controller System Register Enable Register, EL1 ...... B4-529 
B4.32 ICC_SRE_EL42, Interrupt Controller System Register Enable register, EL2... ... B4-531 
B4.33 ICC_SRE_EL3, Interrupt Controller System Register Enable register, EL3... ... B4-533 
B4.34 AArch64 virtual GIC CPU interface register SUMMALY oo... ieeceetee ceteeetteeeeeneeees B4-535 
B4.35 ICV_APORO_EL1, Interrupt Controller Virtual Active Priorities Group O Register 0, 
FEET assgea Res sects ca maaan sca ongeaus access seaetastanen us aeseee dopa anaes siaaeacasseass Momeeae nan S aaanataaraees B4-536 
B4.36 ICV_AP1R0_EL1, Interrupt Controller Virtual Active Priorities Group 1 Register 0, 
| By ape rer ence eee eres ie Prt e Sartre cere cmr ere rere eeerer Cer rere errs eer cre ae erereereree B4-537 
B4.37 ICV_BPRO_EL1, Interrupt Controller Virtual Binary Point Register 0, EL7........ B4-538 
B4.38 ICV_BPR1_EL1, Interrupt Controller Virtual Binary Point Register 1, EL7........ B4-539 
B4.39 ICV_CTLR_EL1, Interrupt Controller Virtual Control Register, EL1 ................... B4-540 
B4.40 AArch64 virtual interface control system register SUMIMALY .....1..::ccceeteeenteee B4-542 
B4.41 ICH_APORO_EL2, Interrupt Controller Hyp Active Priorities Group O Register 0, EL2.... 
gstesiads dese Pacesstecd 20 taleaalaseapsetdasebstes atlectns hediates saa dedattaleat ade Ate nat a pepee heels Ae Ns ode tenaed B4-543 
B4.42 ICH_AP1RO_EL2, Interrupt Controller Hyp Active Priorities Group 1 Register 0, EL2.... 
sxdssacnseuundadubeaabqunceiGeatesunaes aecanisedeleaayseseesneetesiasessequnadilacennngeosess dl eyeeawectesucnedueadonsszoeeed B4-544 
B4.43  ICH_HCR_EL2, Interrupt Controller Hyp Control Register, EL2 B4-545 
B4.44 ICH_VMCR_EL2, Interrupt Controller Virtual Machine Control Register, EL2 .... B4-548 
B4.45 ICH_VTR_EL2, Interrupt Controller VGIC Type Register, EL2 ........0 cee B4-550 
Part C Debug descriptions 
Chapter C1 Debug 
CI.1 “ADOUTAEDUG MOTOS. ss .seiscevesstsseatoueneseceteeesenedvane waceseeeveesesdunenseesseseevinssuzese sees C1-556 
C12 Debug TUNCHONAlAESCHPUION .icsccciecsccessbeesecdenatececenes seed cxtersntorsteenspuecateensneecdvesedoes C1-557 
C13 IDObUG TEGISTOr INLETACOS .iviscsccescessessccveede seiesodecsweneemdorssceravanade vecdenssdr yeveeuesduueecere C1-559 
CIA, JDODUOCVONIS cies tensiaecsiandvcimesmesivanetaiadvantcidunsedouncsieud cvare dena vennteiauvensebaresaeiseduaneeas C1-561 
Ci8 JExternal:C@bUG UNOW ACE: asinzesavncstcestieasnsnescancstarceniess dvaieep nsiaseceaueanaseinectaepenesisoees C1-562 
Chapter C2 PMU 
C27 SAD OUETIGH PIG as cascetdsces teats aeeedunsns de cceenasbacsenvetesacs anduecaaopeddeegsdecasercescabst eedinsaaesdtae C2-564 
C22. PMO TUNCHONAlOOSCHDUOI si :csctissrediecesdedetecasterdatsetescn ctnsedvaesariatutesand Busetentisatess C2-565 
C2.3 External register access permissions to the PMU registers ......0...ccccceeeeeees C2-566 
C24 PIU OVO yacctisscdeces nese ciuninssstiertodergeseebonencugevdecavuacapeesavbeveoesnesesuaceweusneebesdondeaneey C2-567 
C25 IPI IURMORUPES si calascsescncicacticesieassese tesnencbrateneseuindvonvescuteniiossguecteoneseenstaensoueeeendees C2-583 
G26 “Exporting: PMU OVGINS saccicesicessoeiscesebeesevdenascsctveacsnce sebedestterseeserdecaesestuneieeedieasseuee C2-584 
Chapter C3 ETM 
CBs) DADOUETIO ETI sa stesccctacsstisscscteertesdetchacdeendtsuesnele eit vandeednesshnde deh se sesdeeesa ba beatieat C3-586 
C3.2 ETMtrace unit generation Options And reSOUICES .......c2.0:.s0sncces snccsssenssonstzensnes C3-587 
Co3: EM trace unit Tanctional COSCiPUOn sccccecees dessa ses si ssseasatedssuivsdiadiaesvesbdeveddencsnvdetence C3-589 
C84 RESOMING THO ETM ss ccias secsetrceecaccncevenceesacensvaecturecoeeurstieratiesibdeaerescdeesatuneneoesiadeevads C3-590 
C3.5 Programming and reading ETM trace unit reQiSters ........ cesses cette ennteeeeneeees C3-591 
G36 “EITM trace. unit register IntelaCes »2.céscc-cvsetsecsesnccveesstearsee tasvuecstseodseesiteeswoaendenebeee C3-592 
C3.7 Interaction with the: PMU and DODUG ix...ie-csssccvisesecostbesvenes sedesteuecaeecsteceneeestcensnaes C3-593 
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Debug registers 





Chapter D1 AArch32 Debug Registers 
Dit AAKChG2 debug TEGISLGl SUIMIMANY ss ccsiectesianes:avesmscsriusstarienesuasieraseseassinineasesnateds D1-598 
D1.2 DBGBCR, Debug Breakpoint Control R@GIStCMS ......10:.c2c0cccssecses oossececnseoosstaeoeses D1-601 
Dis “DBGDEVID: Debug DEViCGID REGISION ccpscccpszssbeccsacessiscaets pesestieclainsehenma acess D1-604 
Di4 .DBGDEVID1, Debug Device ID REGISION TD ccpssesz:cosaccpsescctznizeaaptbiecaalbasebocisacesiae D1-606 
DIS. “DBGDIDR  DebUG:ID REGISICD sscziciiesuecssscctsapscescosetptausatt cag pasncensotpeesee ea sabtes obeaddote D1-607 
D1.6 DBGWCR, Debug Watchpoint Control REGiSters ......0..cccccetcee ceeentetenteeeeenneees D1-609 
Chapter D2 AArch64 debug registers 
D217. . AAKChO4 debug reGIStel SUIMMANY saxccisvencciz:sitscsnacdensdiobancibsmassseasesoadvteusoaetoaneds D2-612 
D2.2 © DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 w...eccee secre D2-614 
D2.3. DBGCLAIMSET_EL1, Debug Claim Tag Set Register, ELT .....::cccccecc seceeneseeeeees D2-617 
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This preface introduces the Arm® Cortex®-A55 Core Technical Reference Manual. 


It contains the following: 


¢ About this book on page 18. 
¢ Feedback on page 22. 
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Preface 
Product revision status 


About this book 


This Technical Reference Manual is for the Cortex*-A55 core. It provides reference documentation and 
contains programming details for registers. It also describes the memory system, the caches, the 
interrupts, and the debug features. 


Product revision status 


The rmpn identifier indicates the revision status of the product described in this book, for example, rip2, 
where: 


rm Identifies the major revision of the product, for example, rl. 
pn Identifies the minor revision or modification status of the product, for example, p2. 


Intended audience 


This manual is for system designers, system integrators, and programmers who are designing or 
programming a System-on-Chip (SoC) that uses an Arm core. 


Using this book 
This book is organized into the following chapters: 


Part A Functional description 
This part describes the main functionality of the Cortex-A55 core. 


Chapter A1 Introduction 
This chapter provides an overview of the Cortex-A55 core and its features. 


Chapter A2 Technical overview 
This chapter describes the structure of the Cortex-A55 core. 


Chapter A3 Clocks, resets, and input synchronization 
This chapter describes the clocks, resets, and input synchronization of the Cortex-A55 core. 


Chapter A4 Power management 
This chapter describes the power domains and the power modes in the Cortex-A55 core. 


Chapter A5 Memory Management Unit 
This chapter describes the Memory Management Unit (MMU) of the Cortex-A55 core. 


Chapter A6 Level 1 memory system 
This chapter describes the L1 instruction cache and data cache that make up the L1 memory 
system. 


Chapter A7 Level 2 memory system 
This chapter describes the L2 memory system. 


Chapter A8 Reliability, Availability, and Serviceability (RAS) 
This chapter describes the RAS features implemented in the Cortex-A55 core. 


Chapter A9 Generic Interrupt Controller CPU interface 
This chapter describes the Cortex-A55 core implementation of the Arm Generic Interrupt 
Controller (GIC) CPU interface. 


Part B Register Descriptions 
This part describes the system registers of the Cortex-A55 core. 


Chapter B1 AArch32 system registers 
This chapter describes the system registers in the AArch32 state. 


Chapter B2 AArch64 system registers 
This chapter describes the system registers in the AArch64 state. 
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Chapter B3 Error system registers 
This chapter describes the error registers accessed by both the AArch32 error registers and the 
AArch64 error registers. 


Chapter B4 GIC registers 
This chapter describes the GIC registers. 


Part C Debug descriptions 
This part describes the debug functionality of the Cortex-A55 core. 


Chapter C1 Debug 
This chapter describes the debug features of the core. 


Chapter C2 PMU 
This chapter describes the Performance Monitor Unit (PMU). 


Chapter C3 ETM 
This chapter describes the Embedded Trace Macrocell (ETM) for the Cortex-A55 core. 


Part D Debug registers 
This part describes the debug registers of the Cortex-A55 core. 


Chapter D1 AArch32 Debug Registers 
This chapter describes the debug registers in the AArch32 Execution state and shows examples of 
how to use them. 


Chapter D2 AArch64 debug registers 
This chapter describes the debug registers in the AArch64 Execution state and shows examples of 
how to use them. 


Chapter D3 Memory-mapped debug registers 
This chapter describes the memory-mapped debug registers and shows examples of how to use 
them. 


Chapter D4 AArch32 PMU Registers 
This chapter describes the AArch32 PMU registers and shows examples of how to use them. 


Chapter D5 AArch64 PMU registers 
This chapter describes the AArch64 PMU registers and shows examples of how to use them. 


Chapter D6 Memory-mapped PMU registers 
This chapter describes the memory-mapped PMU registers and shows examples of how to use 
them. 


Chapter D7 PMU snapshot registers 
PMU snapshot registers are an IMPLEMENTATION DEFINED extension to an Armv8-A compliant PMU 
to support an external core monitor that connects to a system profiler. 


Chapter D8 ETM registers 
This chapter describes the ETM registers. 


Part E Appendices 
This part describes the appendices of the Cortex-A55 core. 


Appendix A AArch32 UNPREDICTABLE Behaviors 
This appendix describes the cases in which the Cortex-A55 core implementation diverges from 
the preferred behavior described in Armv8-A AArch32 UNPREDICTABLE behaviors. 


Appendix B Revisions 
This appendix describes the technical changes between released issues of this book. 
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Glossary 


The Arm® Glossary is a list of terms used in Arm documentation, together with definitions for those 
terms. The Arm Glossary does not contain terms that are industry standard unless the Arm meaning 
differs from the generally accepted meaning. 


See the Arm® Glossary for more information. 


Typographic conventions 


italic 
Introduces special terminology, denotes cross-references, and citations. 

bold 
Highlights interface elements, such as menu names. Denotes signal names. Also used for terms 
in descriptive lists, where appropriate. 

monospace 
Denotes text that you can enter at the keyboard, such as commands, file and program names, 
and source code. 

monospace 


Denotes a permitted abbreviation for a command or option. You can enter the underlined text 
instead of the full command or option name. 


monospace italic 
Denotes arguments to monospace text where the argument is to be replaced by a specific value. 


monospace bold 
Denotes language keywords when used outside example code. 


<and> 
Encloses replaceable terms for assembler syntax where they appear in code or code fragments. 
For example: 


MRC p15, @, <Rd>, <CRn>, <CRm>, <Opcode_2> 


SMALL CAPITALS 
Used in body text for a few terms that have specific technical meanings, that are defined in the 
Arm® Glossary. For example, IMPLEMENTATION DEFINED, IMPLEMENTATION SPECIFIC, UNKNOWN, and 
UNPREDICTABLE. 


Timing diagrams 


The following figure explains the components used in timing diagrams. Variations, when they occur, 
have clear labels. You must not assume any timing information that is not explicit in the diagrams. 


Shaded bus and signal areas are undefined, so the bus or signal can assume any value within the shaded 
area at that time. The actual level is unimportant and does not affect normal operation. 


Clock 





L__- 


HIGH to LOW. | \ 
Transient Vv. 
HIGH/LOW toHIGH [J 
Bus stable 
Bus to high impedance ee 
Bus change KK 
High impedance to stable bus ; cn 


Figure 1 Key to timing diagram conventions 
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Additional reading 


The signal conventions are: 


Signal level 
The level of an asserted signal depends on whether the signal is active-HIGH or active-LOW. 
Asserted means: 


HIGH for active-HIGH signals. 
LOW for active-LOW signals. 


Lowercase n 


At the start or end of a signal name denotes an active-LOW signal. 


Additional reading 


This book contains information that is specific to this product. See the following documents for other 
relevant information. 


Arm publications 


Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile (DDI 0487). 
Arm® Cortex®-A55 Core Advanced SIMD and Floating-point Support Technical Reference 
Manual (100446). 

Arm® DynamIQ™ Shared Unit Technical Reference Manual (100453). 

Arm® CoreSight™ ELA-500 Embedded Logic Analyzer Technical Reference Manual 
(100127). 

AMBA® AXI and ACE Protocol Specification AXI3, AXI4, AXI5, ACE and ACES (THI 0022). 
AMBA® APB Protocol Version 2.0 Specification (HI 0024). 

Arm® AMBA® 5 CHI Architecture Specification (IHI 0050). 

Arm® CoreSight™ Architecture Specification v3.0 (THI 0029). 

Arm® Debug Interface Architecture Specification, ADIv5.0 to ADIv5.2 (THI 0031). 

AMBA® 4 ATB Protocol Specification (IHI 0032). 

Arm® Generic Interrupt Controller Architecture Specification (THI 0069). 

Arm® Embedded Trace Macrocell Architecture Specification ETMv4 (THI 0064). 

AMBA® Low Power Interface Specification Arm® O-Channel and P-Channel Interfaces (THI 
0068). 


The following confidential documents are only available to licensees: 


Arm® Cortex®-A55 Core Cryptographic Extension Technical Reference Manual (100444). 
Arm® Cortex®-A55 Core Configuration and Sign-off Guide (100443). 

Arm® Cortex®-A55 Core Integration Manual (100445). 

Arm® DynamIQ™ Shared Unit Integration Manual (100455). 

Arm® DynamIQ™ Shared Unit Configuration and Sign-off Guide (100454). 


Other publications 


ANSIJIEEE Std 754-2008, IEEE Standard for Binary Floating-Point Arithmetic. 
Note 


Arm floating-point terminology is largely based on the earlier ANSI/IEEE Std 754-1985 
issue of the standard. See the Arm® Architecture Reference Manual Armv8, for Armv8-A 
architecture profile for more information. 
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Preface 
Feedback on this product 


Feedback 


Feedback on this product 


If you have any comments or suggestions about this product, contact your supplier and give: 

¢ The product name. 

¢ The product revision or version. 

¢ An explanation with as much information as you can provide. Include symptoms and diagnostic 
procedures if appropriate. 


Feedback on content 


If you have comments on content then send an e-mail to errata@arm.com. Give: 


¢ The title Arm Cortex-A55 Core Technical Reference Manual. 

« The number 100442 0200 00 en. 

¢ Ifapplicable, the page number(s) to which your comments refer. 
¢ A concise explanation of your comments. 


Arm also welcomes general suggestions for additions and improvements. 
Note 


Arm tests the PDF only in Adobe Acrobat and Acrobat Reader, and cannot guarantee the quality of the 
represented document when used with any other PDF reader. 
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Part A 


Functional description 


Chapter A1 
Introduction 


This chapter provides an overview of the Cortex-A55 core and its features. 


It contains the following sections: 

¢ Al.1 About the core on page A1-26. 

¢ A1.2 Features on page A1-27. 

¢ AJ.3 Implementation options on page A1-28. 

¢ A1.4 Supported standards and specifications on page A1-29. 
¢ AI.5 Test features on page A1-30. 

¢ A1.6 Design tasks on page Al-31. 

¢ A1.7 Product revisions on page A1-32. 
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A1 Introduction 
A1.1 About the core 


A1.1 About the core 


The Cortex-A55 core is a mid-range, low-power core that implements the Armv8-A architecture with 
support for the Armv8.1-A extension, the Armv8.2-A extension, the RAS extension, the Load acquire 
(LDAPR) instructions introduced in the Armv8.3-A extension, and the dot product instructions 
introduced in the Armv8.4-A extension. 


The core has a Level J (L1) memory system, and private Level 2 (L2) cache. The core is implemented 
inside the DynamIQ Shared Unit (DSU) as a Little core and is highly configurable with other cores. 


The following figure shows an example of a dual-core configuration. 








Cluster 
External memory interface=p> 
Cortex-A55 
Core 0 <—Interrupt interface——»> 





DSU Power management and 
clock control 


<+——__ DF I> 
<—CoreSight infrastructure—p 


Cortex-A55 
Core 1 

















Figure A1-1 Example dual-core configuration with homogeneous cores 


The Cortex-A55 core can also be part of a heterogeneous system. The following figure shows an 
example in which the Cortex-A55 core and another core are integrated into a shared Level 3 (L3) cluster. 
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External memory interface—> 
Other Cortex-A55 








Core 0 Core 0 <+—nterrupt interface—p»> 
DSU Power management and 

a8 clock control — 

Other Cortex-A55 re 


Core 1 Core 1 

















<—CoreSight infrastructure——»> 














Figure A1-2 Example quad-core configuration with heterogeneous cores 


For more information on the permissible combination of cores in the cluster, see appendix Compatible 
Core Versions in the Arm® DynamIQ™ Shared Unit Configuration and Sign-off Guide. 
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A1 Introduction 
A1.2 Features 


A1.2 Features 


The Cortex-A55 core includes the following features: 


Core Features 


Full implementation of the Armv8.2-A A64, A32, and T32 instruction sets. 

Both the AArch32 and AArch64 execution states at all Exception levels (ELO to EL3). 

In-order pipeline with direct and indirect branch prediction. 

Separate L1 data and instruction side memory systems with a Memory Management Unit (MMU). 
Support for Arm TrustZone® technology. 

Optional Data Engine unit that implements the Advanced SIMD and floating-point architecture 
support. 

Optional Cryptographic Extension. This architectural extension is only available if the Data Engine is 
present. 

Generic Interrupt Controller (GIC) CPU interface to connect to an external distributor. 

Generic Timers interface supporting 64-bit count input from an external system counter. 


Cache features 


Optional unified private L2 cache. 
LI and L2 cache protection in the form of Error Correction Code (ECC) or parity on all RAM 
instances. 


Debug features 


Reliability, Availability, and Serviceability (RAS) Extension. 


Armv8.2-A debug logic. 


Performance Monitoring Unit (PMU). 
Embedded Trace Macrocell (ETM) that supports instruction trace only. 
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A1 Introduction 
A1.3 Implementation options 


























A1.3 Implementation options 
The Cortex-A55 core is highly configurable. 
Build-time configuration options make it possible to meet functional requirements with the smallest 
possible area and power. In a configuration with more than one core, all cores have the same build-time 
configuration except for the L2 cache inclusion and size. 
The following table lists the implementation options for a core. 
Table A1-1 Implementation options for a core 
Feature Range of options | Notes 
L1 instruction cache size 16KB - 
32KB 
64KB 
L1 data cache size 16KB - 
32KB 
64KB 
L2 cache Included - 
Not included 
L2 cache size 64KB - 
128KB 
256KB 
ECC or parity core cache protection Included Not available if the L3 cache is implemented without L3 cache 
Not included protection. 
Advanced SIMD and floating-point Included There is no option to implement floating-point without Advanced 
support (including Dot Product instruction Not included SIMD. 
support) 
Cryptographic Extension Included There is no option to implement the Cryptographic Extension 
Not included without the Advanced SIMD and floating-point support. 





CoreSight Embedded Logic Analyzer 
(ELA) 


Optional support 


Support for integrating CoreSight ELA-500. The CoreSight 
ELA-500 is a separately licensable product. 








support 








Not included 





CoreSight ELA RAM address size 2-25 See the Arm® CoreSight™ ELA-500 Embedded Logic Analyzer 
Technical Reference Manual for more details about the RAM 
sizing. 

Page Based Hardware Attributes (PBHA) Included Support for PBHA. For more information, see Page Based 


Hardware Attributes on page AS-71. 
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A1 Introduction 
A1.4 Supported standards and specifications 


A1.4 Supported standards and specifications 


The Cortex-A55 core implements the Armv8-A architecture and some architecture extensions. It also 
supports various interconnect, interrupt, timer, debug, and trace architectures. 


Table A1-2 Compliance with standards and specifications 








Architecture Version Notes 

specification or 

standard 

Arm architecture Armv8-A « AArch64 and AArch32 execution states at all Exception 


levels. 
« A64, A32, and T32 instruction sets. 





Arm architecture 
extensions 


« Armv8.1-A extensions. 

¢«  Armv8.2-A extensions. 

¢ Advanced SIMD and floating- 
point support. 

¢ Cryptographic Extension. 

¢« RAS Extension. 


¢ Armvs.3-A LDAPR instructions. 


« Armv8.4-A dot product 


« You cannot implement floating-point without Advanced 
SIMD. 

« You cannot implement the Cryptographic Extension without 
the Advanced SIMD and floating-point support. 

¢ The Cortex-A55 core implements the LDAPR instructions 
introduced in the v8.3 extensions. 

* The Cortex-A55 core optionally implements the SDOT and 
UDOT instructions introduced in the v8.4 extensions. 























instructions. 

Generic Interrupt GICv4 - 

Controller 

PMU PMUv3 - 

Debug Armv8-A With support for the debug features added by the Armv8.2-A 

extensions. 
CoreSight CoreSightv3 - 
Embedded Trace Macrocell | ETMv4.2 - 











See Additional reading on page 21 for a list of architectural references. 
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A1 Introduction 
A1.5 Test features 


A1.5 Test features 


The Cortex-A55 core provides test signals that enable the use of both Automatic Test Pattern Generation 
(ATPG) and Memory Built-In Self Test (MBIST) to test the core logic and memory arrays. 


For more information, see the Arm® Cortex*-A55 Core Integration Manual. 
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A1 Introduction 
A1.6 Design tasks 


Design tasks 


The Cortex-A55 core is delivered as a synthesizable Register Transfer Level (RTL) description in Verilog 
HDL. Before you can use the Cortex-A55 core, you must implement it, integrate it, and program it. 


A different party can perform each of the following tasks. Each task can include implementation and 
integration choices that affect the behavior and features of the core. 


Implementation 
The implementer configures and synthesizes the RTL to produce a hard macrocell. This task 
includes integrating RAMs into the design. 


Integration 
The integrator connects the macrocell into a SoC. This task includes connecting it to a memory 
system and peripherals. 


Programming 
In the final task, the system programmer develops the software to configure and initialize the 
core and tests the application software. 


The operation of the final device depends on the following: 


Build configuration 
The implementer chooses the options that affect how the RTL source files are pre-processed. 
These options usually include or exclude logic that affects one or more of the area, maximum 
frequency, and features of the resulting macrocell. 


Configuration inputs 
The integrator configures some features of the core by tying inputs to specific values. These 
configuration settings affect the start-up behavior before any software configuration is made. 
They can also limit the options available to the software. 


Software configuration 
The programmer configures the core by programming particular values into registers. The 
configuration choices affect the behavior of the core. 
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A1 Introduction 
A1.7 Product revisions 


A1.7 Product revisions 


This section indicates the first release and, in subsequent releases, describes the differences in 
functionality between product revisions. 

r0p0 First release. 

r0p1 Further development and optimization of the product. 

r1p0 Addition of the dot product instructions that are introduced in the v8.4 architecture extensions. 
r2p0 Addition of PBHA support and support for more L3 cache sizes. 
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Chapter A2 
Technical overview 


This chapter describes the structure of the Cortex-A55 core. 


It contains the following sections: 

¢ A2.1 Components on page A2-34. 

¢ A2.2 Interfaces on page A2-38. 

¢ A2.3 About system control on page A2-39. 

¢ A2.4 About the Generic Timer on page A2-40. 
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A2.1 Components 
The cluster consists of: 


* One to eight cores. 


A2 Technical overview 
A2.1 Components 


¢ The DynamIQ Shared Unit (DSU), which connects the cores to an external memory system. 


For more information, see the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 


The following figure includes a top-level functional diagram of a core. 
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Figure A2-1 Core block diagram 


There are multiple asynchronous bridges between the Cortex-A55 core and the DSU. Only the coherent 
interface between the Cortex-A55 core and the DSU can be configured to run synchronously, however it 
does not affect the other interfaces such as debug, trace, and GIC which are always asynchronous. For 
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A2 Technical overview 
A2.1 Components 


more information on how to set the coherent interface to run either synchronously or asynchronously, see 
Configuration Guidelines in the Arm® DynamIQ™ Shared Unit Configuration and Sign-off Guide. 





Instruction Fetch Unit (IFU) 


The IFU fetches instructions from the instruction cache or from external memory and predicts the 
outcome of branches in the instruction stream. It passes the instructions to the Data Processing Unit 
(DPU) for processing. 


Data Processing Unit (DPU) 


The DPU decodes and executes instructions. It executes instructions that require data transfer to or from 
the memory system by interfacing to the Data Cache Unit (DCU). The DPU includes the PMU, the 
Advanced SIMD and floating-point support, and the Cryptographic Extension. 


PMU 


The PMU provides six performance monitors that can be configured to gather statistics on the 
operation of each core and the memory system. The information can be used for debug and code 
profiling. 


Advanced SIMD and floating-point support 


Advanced SIMD is a media and signal processing architecture that adds instructions primarily 
for audio, video, 3D graphics, image and speech processing. The floating-point architecture 
provides support for single-precision and double-precision floating-point operations. 


All scalar floating-point instructions are available in the A64 instruction set. 
All VFP instructions are available in the A32 and T32 instruction sets. 


The A64 instruction set offers additional Advanced SIMD instructions, including double- 
precision floating-point vector operations. 
Note 


The Advanced SIMD architecture, its associated implementations, and supporting software, are 
also referred to as NEON™ technology. 








Cryptographic Extension 
The optional Cortex-A55 core Cryptographic Extension supports the Armv8-A Cryptographic 
Extension. It is a configuration option that can be set when configuring and integrating the core 
into a system and applies to all cores. The Cryptographic Extension adds new instructions to 
Advanced SIMD that accelerate: 
¢ Advanced Encryption Standard (AES) encryption and decryption. 
¢ The Secure Hash Algorithm (SHA) functions SHA-1, SHA-224, and SHA-256. 
¢ Finite field arithmetic used in algorithms such as Galois/Counter Mode and Elliptic Curve 

Cryptography. 


Memory Management Unit (MMU) 


The MMU provides fine-grained memory system control through a set of virtual-to-physical address 
mappings and memory attributes that are held in translation tables. These are saved into the Translation 
Lookaside Buffer (TLB) when an address is translated. The TLB entries include global and Address 
Space Identifiers (ASIDs) to prevent context switch TLB flushes. They also include Virtual Machine 
Identifiers (VMIDs) to prevent TLB flushes on virtual machine switches by the hypervisor. 


L1 TLBs 
The first level of caching for the translation table information is an L1 TLB. It is implemented 
on both of the instruction and data sides. All TLB-related maintenance operations result in 
flushing both the instruction and data L1 TLBs. 
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A2 Technical overview 
A2.1 Components 


L2 TLB 
A unified L2 TLB handles the misses from the L1 TLBs. 


In implementations with core cache protection, parity bits protect the TLB RAMs by enabling 
the detection of any single-bit error. If an error is detected, the entry is invalidated and fetched 
again. 


L1 memory system 
The L1 memory system includes the DCU, the Store Buffer (STB), and the Bus Interface Unit (BIU). 
DCU 

The DCU manages all load and store operations. 


The L1 data cache RAMs are protected using Error Correction Codes (ECC). The ECC scheme 
is Single Error Correct Double Error Detect (SECDED). The DCU includes a combined local 
and global exclusive monitor that is used by Load-Exclusive and Store-Exclusive instructions. 


STB 


The STB holds store operations when they have left the load/store pipeline in the DCU and have 
been committed by the DPU. The STB can request access to the L1 data cache, initiate linefills, 
or write to L2 and L3 memory systems. 


The STB is also used to queue maintenance operations before they are broadcast to other cores 
in the cluster. 


BIU 
The BIU contains the interface to the L2 memory system and buffers to decouple the interface 
from the L1 data cache and STB. 


L2 memory system 


The L2 memory system contains the L2 cache. The L2 cache is optional and private to each core. The L2 
cache is 4-way set associative, supports 64-byte cache lines, and has a configurable cache RAM size 
between 64KB and 256KB. The L2 memory system is connected to the DynamIQ Shared Unit through 
an optional asynchronous bridge. 


GIC CPU interface 


The GIC CPU interface, when integrated with an external distributor component, is a resource for 
supporting and managing interrupts in a cluster system. 


DynamlQ” Shared Unit 


The DynamIQ Shared Unit (DSU) contains the L3 cache and logic required to maintain coherence 
between the cores in the cluster. For more information, see the Arm® DynamIQ™ Shared Unit Technical 
Reference Manual. 


Debug and trace components 

The Cortex-A55 core supports a range of debug, test, and trace options including: 
¢ Six performance event counters, provided by the PMU, and one cycle counter. 
¢ Six hardware breakpoints, and four watchpoints. 

¢ Per-core instruction trace only ETM. 

¢ Per-core support for an ELA-500. 

¢« AMBA 4 APB interfaces between the cluster and the DebugBlock. 


Details of the core-specific debug elements can be found in this document. For information on the cluster 
debug and trace components supported by the Cortex-A55 core, see the Arm® DynamIQ™ Shared Unit 
Technical Reference Manual. 
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A2 Technical overview 
A2.1 Components 


Related reference 

Chapter A5 Memory Management Unit on page AS-61 

Chapter A6 Level I memory system on page A6-73 

Chapter A7 Level 2 memory system on page A7-93 

Chapter A9 Generic Interrupt Controller CPU interface on page A9-109 
Chapter CI Debug on page C1-555 

Chapter C2 PMU on page C2-563 

Chapter C3 ETM on page C3-585 
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A2 Technical overview 
A2.2 Interfaces 


A2.2 Interfaces 


The Cortex-A55 core has several interfaces to connect it to a SoC. The DSU manages all interfaces. 


For information on the interfaces, see the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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A2 Technical overview 
A2.3 About system control 


A2.3 About system control 


The system registers control and provide status information for the functions that the core implements. 


The main functions of the system registers are: 


Overall system control and configuration. 
MMU configuration and management. 
Cache configuration and management. 
System performance monitoring. 

GIC configuration and management. 


The system registers are accessible in the AArch64 and AArch32 Execution states. Some of the system 
registers are accessible through the external debug interface. 
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A2 Technical overview 
A2.4 About the Generic Timer 


A2.4 About the Generic Timer 


The Generic Timer can schedule events and trigger interrupts that are based on an incrementing counter 
value. It generates timer events as active-LOW interrupt outputs and event streams. 


The Cortex-A55 core provides a set of timer registers. The timers are: 
« An ELI! Non-secure physical timer. 

¢ An EL2 Hypervisor physical timer. 

¢ An EL3 Secure physical timer. 

¢ A virtual timer. 

¢ A Hypervisor virtual timer. 


The Cortex-A55 core does not include the system counter. This resides in the SoC. The system counter 
value is distributed to the core with a 64-bit bus. 


For more information on the Generic Timer, see the Arm® DynamIQ™ Shared Unit Technical Reference 
Manual and the Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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Chapter A3 
Clocks, resets, and input synchronization 


This chapter describes the clocks, resets, and input synchronization of the Cortex-A55 core. 


It contains the following sections: 


¢ A3.1 About clocks, resets, and input synchronization on page A3-42. 
¢ A3.2 Asynchronous interface on page A3-43. 
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A3 Clocks, resets, and input synchronization 
A3.1 About clocks, resets, and input synchronization 


A3.1 About clocks, resets, and input synchronization 
The Cortex-A55 core supports hierarchical clock gating. 


The Cortex-A55 core contains several interfaces that connect to other components in the system. These 
interfaces can be in the same clock domain or in other clock domains. 


For information about clocks, resets, and input synchronization, see the Arm® DynamIQ™ Shared Unit 
Technical Reference Manual. 
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A3 Clocks, resets, and input synchronization 
A3.2 Asynchronous interface 


A3.2 Asynchronous interface 


Your implementation can include an optional asynchronous interface between the core and the DSU top 
level. 


See the Arm® DynamIOQ™ Shared Unit Technical Reference Manual for more information. 
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A3 Clocks, resets, and input synchronization 
A3.2 Asynchronous interface 





100442 _0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights reserved. A3-44 
Non-Confidential 


Chapter A4 
Power management 


This chapter describes the power domains and the power modes in the Cortex-A55 core. 


It contains the following sections: 

¢ A4.1 About power management on page A4-46. 

¢ A4.2 Voltage domains on page A4-47. 

¢ A4.3 Power domains on page A4-48. 

¢ A4.4 Architectural clock gating modes on page A4-50. 
¢ A4.5 Power control on page A4-52. 

¢ A4.6 Power modes on page A4-53. 

¢ A4.7 Encoding for power modes on page A4-57. 

¢ A4.8 Power down sequence on page A4-58. 

¢ A4.9 Debug over powerdown on page A4-59. 
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A4 Power management 
A4.1 About power management 


A4.1 About power management 
The Cortex-A55 core provides mechanisms to control both dynamic and static power dissipation. 
The dynamic power management includes the following features: 


¢ Architectural clock gating. 
¢ Per-core Dynamic Frequency Scaling (DFS). 
The static power management includes the following features: 


¢ Dynamic retention. 
* Powerdown. 


Related reference 
A4.3 Power domains on page A4-48 
A4.5 Power control on page A4-52 
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A4 Power management 
A4.2 Voltage domains 


A4.2 Voltage domains 


The Cortex-A55 core supports a VCPU voltage domain and a VSYS voltage domain. 


The following figure shows the VCPU and VSYS voltage domains in each Cortex-A55 core and in the 
DSU. The example shows a configuration with four Cortex-A55 cores. 





i} VCPUO L} VCPU2 
L} VCPU1 ~} VCPU3 
B® vsys 


Figure A4-1 Cortex-A55 voltage domains 


Asynchronous bridge logic exists between the voltage domains. The Cortex-A55 core logic and core 
clock domain of the asynchronous bridge are in the VCPU voltage domain. The DSU clock domain of 
the asynchronous bridge is in the VSYS voltage domain. 

Note 


You can tie VCPU and VSYS to the same supply if one of the following conditions is met: 


¢ The core is configured to run synchronously with the DSU sharing the same clock. 
¢ The core is not required to support DVFS. 
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A4 Power management 
A4.3 Power domains 


A4.3 Power domains 


The Cortex-A55 core supports multiple power domains. 


The following figure shows the power domains in the Cortex-A55 core. The colored boxes indicate the 


PDADVSIMD, PDCPU, and PDSYS power domains, with respective voltage domains shown in dotted 
lines. 
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Figure A4-2 Cortex-A55 core power domains 
In a DSU cluster, there might be multiple Cortex-A55 cores. The following figure shows the power 
domains for four Cortex-A55 cores in a DSU cluster. Everything in the same color is part of the same 
power domain. The number of power domains increases based on the number of cores present. This 
example only shows the power domains that are associated with the Cortex-A55 cores. For information 
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A4 Power management 
A4.3 Power domains 


on the other power domains required for a DSU cluster, see the Power management chapter of the Arm® 
DynamIQ™ Shared Unit Technical Reference Manual. 
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Figure A4-3 Cortex-A55 power domains 
Note 


You do not need to use the full flexibility that the Cortex-A55 clock, voltage, and power domains 
provide. 





The Advanced SIMD and floating-point block in each core is also part of the power domain for that core. 
However, to support independent retention control, each Advanced SIMD and floating-point block also 
has its own power domain for isolation from the surrounding domain. 


The following table shows the power domains that the Cortex-A55 core supports. 


Table A4-1 Power domain description 





Power domain 


Description 





PDCPU<n> 


This domain contains all ananke_cpu logic and cpu clock domain logic of the asynchronous bridge. It also 
includes the optional Advanced SIMD and floating-point block, the L1 and L2 TLBs, L1 and L2 core RAMs, and 
debug registers that are associated with the core. 


<n> where n is the core number in the range 0-7. The number represents core 0, core 1, core 2, to core 7. If a core 
is not present, the corresponding power domain is not present. 





PDADVSIMD<n> 


This is an optional power domain for Advanced SIMD and floating-point block to implement dynamic retention. 


<n> where n is the core number in the range 0-7. The number represents core 0, core 1, core 2, to core 7. If a core 
is not present, the corresponding power domain is not present. 








PDSYS 





This domain contains the cluster clock domain logic of the asynchronous bridge. 








Clamping cells between power domains are inferred rather than instantiated in the RTL. 
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A4 Power management 
A4.4 Architectural clock gating modes 


A4.4 Architectural clock gating modes 


When the Cortex-A55 core is in standby mode, it is architecturally clock gated at the top of the clock 
tree. 


Wait for Interrupt (WF) and Wait for Event (WFE) are features of Armv8-A architecture that put the 
core in a low-power standby mode by architecturally disabling the clock at the top of the clock tree. The 
core is fully powered and retains all the state in standby mode. 


A4.4.1 Core Wait for Interrupt 


WFI puts the core in a low-power state by disabling most of the clocks in the core, while keeping the 
core powered up. 


There is a small dynamic power overhead from the logic that is required to wake up the core from WFI 
low-power state. Other than this, the power that is drawn is reduced to static leakage current only. 


When the core executes the WFI instruction, the core waits for all instructions in the core to retire before 
it enters low-power state. The WFI instruction ensures that all explicit memory accesses that occurred 
before the WFI instruction in program order have retired. 


In addition, the WFI instruction ensures that store instructions have updated the cache or have been issued 
to the L3 memory system. 


While the core is in WFI low-power state, the clocks in the core are temporarily enabled without causing 
the core to exit WFI low-power state when any of the following events are detected: 


¢« AnL3 snoop request that must be serviced by the core data caches. 

¢ Acache or TLB maintenance operation that must be serviced by the core L1 instruction cache, data 
cache, TLB, or L2 cache. 

¢ An APB access to the debug or trace registers residing in the core power domain. 

« AGIC CPU access through the AXI4 stream channel. 


Exit from WFI low-power state occurs when one of the following occurs: 
¢ The core detects one of the WFI wake-up events. 
¢ The core detects a reset. 


For more information, see the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture 
profile. 


A4.4.2 Core Wait for Event 


WFE is a feature of the Armv8-A architecture. It uses a locking mechanism based on events, to put the 
core in a low-power state by disabling most of the clocks in the core, while keeping the core powered up. 


There is a small dynamic power overhead from the logic that is required to wake up the core from WFE 
low-power state. Other than this, the power that is drawn is reduced to static leakage current only. 


A core enters into WFE low-power state by executing the WFE instruction. When the WFE instruction 
executes, the core waits for all instructions in the core to complete before it enters the idle or low-power 
state. 


If the event register is set, execution of WFE does not cause entry into standby state, but clears the event 
register. 


While the core is in WFE low-power state, the clocks in the core are temporarily enabled without causing 
the core to exit WFE low-power state when any of the following events are detected: 


« AnL3 snoop request that must be serviced by the core data caches. 

¢ Acache or TLB maintenance operation that must be serviced by the core L1 instruction cache, data 
cache, TLB, or L2 cache. 

¢« An APB access to the debug or trace registers residing in the core power domain. 

« AGIC CPU access through the AXI4 stream channel. 
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Exit from WFE low-power state occurs when one of the following occurs: 

¢ The core detects one of the WFE wake-up events. 

¢ The EVENTI input signal is asserted. 

¢ The core detects a reset. 

For more information, see the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture 
profile. 

Related reference 

A4.8 Power down sequence on page A4-58 
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A4.5 Power control 


All power mode transitions are performed at the request of the power controller, using a P-Channel 
interface to communicate with the Cortex-A55 core. 


There is one P-Channel per core, plus one P-Channel for the cluster. The Cortex-A55 core provides the 
current requirements on the PACTIVE signals, so that the power controller can make decisions and 
request any change with PREQ and PSTATE. The Cortex-A55 core then performs any actions necessary 
to reach the requested power mode, such as gating clocks, flushing caches, or disabling coherency, before 
accepting the request. 


If the request is not valid, either because of an incorrect transition or because the status has changed so 
that state is no longer appropriate, then the request is denied. The power mode of each core can be 
independent of other cores in the cluster, however the cluster power mode is linked to the mode of the 
cores. 
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A4.6 Power modes 


The following figure shows the supported modes for each core domain, and the legal transitions between 
them. 


















SIMD 
Dynamic 
Retention 


Core 
Dynamic 
Retention 


From Any 
Mode 






Off 
(Emulated) 


Figure A4-4 Cortex-A55 Core Power Domain Mode Transitions 


The darker (blue) blocks indicate the modes that the core can be initialized into. The dotted line 
transition from On to Core Dynamic Retention is only allowed if SIMD retention is not implemented or 
has been disabled. 


The power domains can be controlled independently to give different combinations when powered-up 
and powered-down. 


However, only some powered-up and powered-down domain combinations are valid and supported. The 
following table describes the power modes, and the corresponding supported power domain states for 
individual cores. 


Caution 


States that are not shown in the following tables are unsupported and must not occur. 


Table A4-2 Supported core power mode and power domain states 





Power mode Power domain Description 





PDCPU | PDPADVSIMD 














Debug recovery On On Core on. Advanced SIMD and floating-point block on. Block is active. 

On On On Core on. Advanced SIMD and floating-point block on. Block is active. 

SIMD dynamic retention | On Ret Core on. Advanced SIMD and floating-point block in retention. Block is active. 
Core dynamic retention | Ret Ret Core retention. Core logic and Advanced SIMD and floating-point block in 


retention. Logic and RAM retention power only. 





























Off (emulated) On On Core on. Advanced SIMD and floating-point block on. Block is active. 

Off Off Off Core off. Power to the block is gated. 
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Deviating from the legal power modes can lead to UNPREDICTABLE results. You must comply with the 
dynamic power management and powerup and powerdown sequences described in the following 
sections. 


This section contains the following subsections: 

* A4.6.1 On on page A4-54. 

° A4.6.2 Offon page A4-54. 

¢ A4.6.3 Off (emulated) on page A4-54. 

¢ A4.6.4 SIMD dynamic retention on page A4-54. 
¢ A4.6.5 Core dynamic retention on page A4-55. 
¢ A4.6.6 Debug recovery on page A4-55. 





A4.6.1 On 
In this mode, the core is on and fully operational. 
The core can be initialized into the On mode. If the core does not use P-Channel, you can tie the core in 
the On mode by tying PREQ LOW. 
When a transition to the On mode completes, all caches are accessible and coherent. Other than the 
normal architectural steps to enable caches, no additional software configuration is required. 
When the core domain P-Channel is initialized into the On mode, either as a shortcut for entering that 
mode or as a tie-off for an unused P-Channel, it is an assumed transition from the Off mode. This 
includes an invalidation of any cache RAM within the core domain. 

A4.6.2 Off 
The Cortex-A55 core supports a full shutdown mode where power can be removed completely and no 
state is retained. 
The shutdown can be for either the whole cluster or just for an individual core, which allows other cores 
in the cluster to continue operating. 
In this mode, all core logic and RAMs are off. The domain is inoperable and all core state is lost. The L1 
and L2 caches are disabled, flushed and the core is removed from coherency automatically on transition 
to Off mode. 
A Cold reset can reset the core in this mode. 
The core P-Channel can be initialized into this mode. 
An attempted debug access when the core domain is off returns an error response on the internal debug 
interface indicating the core is not available. 

A4.6.3 Off (emulated) 
In this mode, all core domain logic and RAMs are kept on. However, core warm reset can be asserted 
externally to emulate a power off scenario while keeping core debug state and allowing debug access. 
All debug registers must retain their mode and be accessible from the external debug interface. All other 
functional interfaces behave as if the core were Off. 

A4.6.4 SIMD dynamic retention 
In this mode, the Advanced SIMD and floating-point logic is in retention (inoperable but with state 
retained) and the remainder of the core logic is operational. 
This means that if an Advanced SIMD and floating-point instruction is executed while in this mode, it is 
stalled until the core enters the On mode. 
When the Advanced SIMD and floating-point logic is in retention, the clock to the logic is automatically 
gated outside of the retained domain. 
The SIMD dynamic retention is controlled by the CPUPWRCTLR.SIMD_ RET CTRL bit. 
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Related reference 
B2.35 CPUPWRCTLR_EL1, Power Control Register, ELI on page B2-351 


A4.6.5 Core dynamic retention 


In this mode, all core logic and RAMs are in retention and the core domain is inoperable. The core can 
be entered into this power mode when it is in WFI or WFE mode. 


The core dynamic retention can be enabled and disabled separately for WFI and WFE by software 
running on the core. Separate timeout values can be programmed for entry into this mode from WFI and 
WFE mode: 


« Use the CPUPWRCTLR.WFL RET CTRL register bits to program timeout values for entry into core 
dynamic retention mode from WFI mode. 

¢ Use the CPUPWRCTLR.WFE RET CTRL register bits to program timeout values for entry into 
core dynamic retention mode from WFE mode. 


When in dynamic retention and the core is synchronous to the cluster, the clock to the core is 
automatically gated outside of the domain. However, if the core is running asynchronous to the cluster, 
the system integrator must gate the clock externally during core dynamic retention. For more 
information, see the Arm® DynamIQ™ Shared Unit Configuration and Sign-off Guide. 


The outputs of the domain must be isolated to prevent buffers without power from propagating UNKNOWN 
values to any operational parts of the system. 


When the core is in dynamic retention there is support for Snoop, GIC, and debug access, so the core 
appears as if it were in WFI or WFE mode. When such an incoming access occurs, it stalls and the On 
PACTIVE bit is set HIGH. The incoming access proceeds when the domain is returned to On using P- 
Channel. 


When the incoming access completes, and if the core has not exited WFI or WFE mode, then the On 
PACTIVE bit is set LOW after the programmed retention timeout. The power controller can then 
request to reenter the core dynamic retention mode. 

Note 


If SIMD dynamic retention is implemented and enabled, then the core does not indicate on PACTIVE 
that it can enter core dynamic retention until it is already in SIMD dynamic retention. 








Related reference 
B2.35 CPUPWRCTLR_EL1, Power Control Register, ELI on page B2-351 


A4.6.6 Debug recovery 
Debug recovery can be used to assist debug of external watchdog-triggered reset events. 


It allows contents of the core L1 data and L2 caches that were present before the reset to be observable 
after the reset. The contents of the caches are retained and are not altered on the transition back to the On 
mode. 


By default, the core invalidates its caches when transitioning from Off to On mode. If P-Channel is 
initialized to debug recovery, and the core is cycled through Cold or Warm reset along with system 
resets, then the cache invalidation is disabled. The cache contents are preserved when the core is 
transitioned to the On mode. 


Debug recovery also supports preserving Reliability, Availability, and Serviceability (RAS) state, in 
addition to the cache contents. In this case, a transition to debug recovery is made from any of the current 
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states. Once in debug recovery mode, a cluster-wide Warm reset must be applied externally. The RAS 
and cache state are preserved when the core is transitioned to the On mode. 


Caution 


Debug recovery is strictly for debug purposes. It must not be used for functional purposes, as correct 

operation of the caches is not guaranteed when entering this mode. 

¢ This mode can occur at any time with no guarantee of the state of the core. A P-Channel request of 
this type is accepted immediately, therefore its effects on the core, cluster, or the wider system are 
unpredictable, and a wider system reset might be required. In particular, if there were outstanding 
memory system transactions at the time of the reset, then these might complete after the reset when 
the core is not expecting them and cause a system deadlock. 

¢ Ifthe system sends a snoop to the cluster during this mode, then depending on the cluster state, the 
snoop might get a response and disturb the contents of the caches, or it might not get a response and 
cause a system deadlock. 
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The following table shows the encodings for the supported modes for each core domain P-Channel. 


Table A4-3 Core Power Modes COREPSTATE Encoding 



































Power Mode Short Name PACTIVE Bit PSTATE value? | Power Mode Description 
Number 
Debug Recovery DEBUG_RECOV | - 0bee10108 Logic is off (or in reset), RAM state is retained and 
not invalidated when transition to On mode. 
On ON 8 @be010e0 All powerup. 
SIMD Dynamic FUNC_RET 7 0b00e111 SIMD logic is in retention and inoperable. All 
Retention other logic is on and operational. 
Core Dynamic FULL_RET 5 @bee0101 Logic and RAM State are inoperable but retained. 
Retention 
Off (Emulated) OFF_EMU 1 0be00001 On with Warm reset asserted, debug state is 
retained and accessible. 
Off OFF 0 (implicit)® ebeeeeee 


All powerdown. 











a PSTATE[5:4] are don't care. 
It is tied off to 0 and should be inferred when all other PACTIVE bits are LOW. For more information, see the AMBA® Low Power Interface Specification Arm" Q- 
Channel and P-Channel Interfaces. 
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A4.8 Power down sequence 
The Cortex-A55 core uses the following power down sequence. 
To power down a core, perform the following programming sequence: 


1. Save all architectural state. 

2. Configure the GIC distributor to disable or reroute interrupts away from this core. 

3. Set the CPUPWRCTLR.CORE PWRDN EN bit to | to indicate to the power controller that a 
powerdown is requested. 

4. Execute an /nstruction Synchronization Barrier (ISB) instruction. 

5. Execute a WFI instruction. 

After executing WFI and then receiving a powerdown request from the power controller, the hardware 

performs the following: 

¢ Disabling and flushing of caches (L1 and L2). 

* Removal of the core from coherency. 


Note 


When the CPUPWRCTLR.CORE PWRDN EN bit is set, executing a WFI instruction automatically 
masks all interrupts and wake-up events in the core. As a result, applying reset is the only way to wake 
up the core from this WFI. 





Related reference 
B2.35 CPUPWRCTLR_EL1, Power Control Register, ELI on page B2-351 
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A4.9 Debug over powerdown 


The Cortex-A55 core supports debug over powerdown, which allows a debugger to retain its connection 
with the core even when powered down. This enables debug to continue through powerdown scenarios, 
rather than having to re-establish a connection each time the core is powered up. 


The debug over powerdown logic is part of the DebugBlock, which is external to the cluster, and must 
remain powered on during the debug over powerdown process. 


See the Arm® DynamIO™ Shared Unit Technical Reference Manual. 
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This chapter describes the Memory Management Unit (MMU) of the Cortex-A55 core. 


It contains the following sections: 

¢ A5.1 About the MMU on page AS-62. 

¢ A5.2 TLB organization on page A5-64. 

¢ A5.3 TLB match process on page A5-65. 

¢ A5.4 Translation table walks on page A5-66. 

¢ A5.5 MMU memory accesses on page A5-67. 

¢ A53.6 Responses on page A5-69. 

¢ A5.7 Page Based Hardware Attributes on page AS-71. 
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A5.1 About the MMU 


The Memory Management Unit (MMU) is responsible for translating addresses of code and data Virtual 
Addresses (VA) to Physical Addresses (PAs) in the real system. The MMU also controls memory access 
permissions, memory ordering, and cache policies for each region of memory. 


A5.1.1 Main functions 
The three main functions of the MMU are to: 


¢ Control the translation table walk hardware that accesses translation tables in main memory. 

¢ Translate Virtual Addresses (VAs) to Physical Addresses (PAs). 

¢ Provide fine-grained memory system control through a set of virtual-to-physical address mappings 
and memory attributes that are held in translation tables. 


Each stage of address translation uses a set of address translations and associated memory properties that 
are held in memory mapped tables called translation tables. Translation table entries can be cached into a 
Translation Lookaside Buffer (TLB). 


The following table describes the components included in the MMU. 


Table A5-1 TLBs and TLB caches in the MMU 





Component Description 





Instruction L1 TLB | 15 entries, fully associative 





Data L1 TLB 16 entries, fully associative 





L2 TLB 1024 entries, 4-way set associative 





Walk cache RAM __| 64 entries, 4-way set associative 














IPA cache RAM 64 entries, 4-way set associative 





L2 TLB entries contain global and Address Space Identifiers (ASID) to prevent context switch TLB 
flushes. 


The TLB entries contain a Virtual Machine Identifier (VMID) to prevent context switch TLB flushes on 
virtual machine switches by the hypervisor. 


The Cortex-A55 core supports a 40-bit physical address range, which allows ITB of physical memory to 
be addressed. 


A5.1.2 AAarch32 and AArch64 behavior differences 


The Cortex-A55 core is an Armv8-A compliant core that supports execution in both AArch32 and 
AArch64 states. 


The following table shows the behavior differences between both execution states. 
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Table A5-2 AAarch32 and AArch64 behavior differences 





AArch32 


AArch64 





Address translation 
system 


The Armv8-A address translation system 
resembles the Armv7 address translation 
system with Large Physical Address 
Extension (LPAE) and Virtualization 
Extensions. 


The Armv8-A address translation system resembles an extension to 
the Long descriptor format address translation system to support the 
expanded virtual and physical address space. 





Translation granule 


4KB for both Virtual Memory System 
Architecture (VMSA) and LPAE. 


4KB, 16KB, or 64KB for LPAE. 











ASID size 8 bits. 8 or 16 bits, depending on the value of TCR_ELx.AS 
VMID size 8 bits. 8 or 16 bits, depending on the value of VTCR_EL2.VS 
PA size 40 bits only. Maximum 40 bits. 











Any configuration of TCR_ELx.IPS over 40 bits is considered as 40 
bits. You can enable or disable each stage of the address translation 
independently. 








The Cortex-A55 core also supports the Virtualization Host Extension (VHE) including ASID space for 
EL2. When VHE is implemented and enabled, EL2 has the same behavior as EL1. 


See the Arm® Architecture Reference Manual Armv8, for Armv8s-A architecture profile for more 
information on concatenated translation tables and for address translation formats. 
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A5.2 TLB organization 


The Jranslation Lookaside Buffer (TLB) is a cache of recently executed page translations within the 
MMU. The Cortex-A55 core implements a two-level TLB structure. The L2 TLB stores all page sizes 
and is responsible for breaking these down into smaller pages when required for the data-side or 
instruction-side L1 TLB. 


TLB lockdown is not supported. 


After reset, an Invalidate All operation is executed and all entries in the TLB are invalidated. 


A5.2.1 L1 TLB 


The first level of caching for the translation table information is an L1 TLB, implemented on each of the 
instruction and data sides. 


The Cortex-A55 L1 instruction TLB supports 4KB, 16KB, 64KB, and 2MB pages. 
The Cortex-A55 L1 data TLB supports 4KB pages only. 
Any other page sizes are fractured after the L2 TLB and the appropriate page size sent to the L1 TLB. 


All TLB maintenance operations affect both the L1 instruction and data TLBs and cause them to be 
invalidated. 


A5.2.2 L2 TLB 
A unified L2 TLB handles any misses from the L1 instruction and data TLBs. 


¢ A 4-way, set-associative, 1024-entry cache. 

¢ Supports all Virtual Memory System Architecture (VMSA) block sizes, except for 1GB, as described 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. See VMSAv8 in 
the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for more 
information. 


If a 1GB block is fetched, it is split into 512MB blocks and the appropriate block for the lookup is stored. 


Accesses to the L2 TLB take a variable number of cycles, based on: 
¢ Competing requests from the L1 TLBs. 

¢ TLB maintenance operations in flight. 

¢ Different page size mappings in use. 


A5.2.3 IPA cache RAM 


The Intermediate Physical Address (IPA) cache RAM holds mappings between the IPAs and Physical 
Addresses (PAs). 


Only Non-secure EL1 and ELO stage 2 translations use the IPA cache. When a stage 2 translation 
completes, the cache is updated. The IPA cache is checked whenever a stage 2 translation is required. 


Like the L2 TLB, the IPA cache RAM can hold entries for different sizes. 


A5.2.4 Walk cache RAM 


The walk cache RAM holds the result of a stage 1 translation up to, but not including, the last level. 
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A5.3 TLB match process 


The Armv8-A architecture provides support for multiple maps from the VA space that are translated 
differently. 


TLB entries store the context information that is required to facilitate a match and avoid the need for a 
TLB flush on a context or virtual machine switch. 


Each TLB entry contains a: 


« VA, 
* PA. 
¢ Set of memory properties that include type and access permissions. 


Each entry is either associated with a particular Address Space Identifier (ASID) or is global. In addition, 
each TLB entry contains a field to store the Virtual Machine Identifier (VMID) in the entry applicable to 
accesses from Non-secure ELO and EL1 Exception levels. 


Each entry is associated with a particular translation regime. 


¢ EL3 in Secure state in AArch64 only. 

¢ EL2 (or ELO in VHE mode) in Non-secure state. 

¢ ELI or ELO in Secure state or EL3 in Secure state in AArch32. 
¢« ELI or ELO in Non-secure state. 


A TLB match entry occurs when the following conditions are met: 

¢« When VA[48:N] matches the requested address, where N is log, of the block size for that translation 
that is stored in the TLB entry, moderated by the page size. 

« When the memory space matches the memory space state of the requests. The memory space can be 
one of the four states mentioned above. 

¢ The ASID matches the current ASID held in the CONTEXTIDR, TTBRO, or TTBR1 register, or the 
entry is marked global. 

¢ The ASID matches are ignored for requests originating from EL2 when not in VHE mode or from 
EL3 in AArch6é4. 

¢ The VMID matches the current VMID held in the VTTBR_EL2 register. 

¢« The VMID match is ignored for a request not originating from Non-secure ELO or ELI. 
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A5.4 Translation table walks 
When the Cortex-A55 core generates a memory access, the MMU: 


1. Performs a lookup for the requested VA and current translation regime in the relevant instruction or 
data L1 TLB. 

2. If there is a miss in the relevant L1 TLB, the MMU performs a lookup for the requested VA, current 
ASID, current VMID, and translation regime in the L2 TLB. 

3. If there is a miss in the L2 TLB, the MMU performs a hardware translation table walk. 


In the case of an L2 TLB miss, the hardware does a translation table walk as long as the MMU is 
enabled, and the translation using the base register has not been disabled. 


If the translation table walk is disabled for a particular base register, the core returns a Translation Fault. 
If the TLB finds a matching entry, it uses the information in the entry as follows. 


The access permission bits and the domain determine if the access is permitted. If the matching entry 

does not pass the permission checks, the MMU signals a Permission fault. See the Arm® Architecture 

Reference Manual Armvé, for Armv8-A architecture profile for details of Permission faults, including: 
¢ A description of the various faults. 

¢ The fault codes. 

¢ Information regarding the registers where the fault codes are set. 


Note 
In AArch32 VMSA Short-descriptor format, the permission check includes the domain properties. 








A5.4.1 AArch64 behavior 


When executing in AArch64 state at a particular Exception level, you can configure the hardware 
translation table walk to use either the 4KB, 16KB, or 64KB translation granule. Program the Translation 
Granule bit, TGO, in the appropriate translation control register: 


* TCR ELI. 
- TCR EL2. 
* TCR EL3. 
* VTCR_EL2. 


For TCR_EL1, you can program the Translation Granule bits TGO and TG1 to configure the translation 
granule respectively for TTBRO_EL1 and TTBR1_ EL1, or TCR_EL2 when VHE is enabled. 


A5.4.2 AArch32 behavior 


When executing in AArch32 state in a particular mode, you can configure the MMU to perform 
hardware translation table walks using either the Short-descriptor translation table format, or the Long- 
descriptor translation table format. This is controlled by programming the Extended Address Enable 
(EAE) bit in the appropriate Secure or Non-secure Translation Table Base Control Register (TTBCR). 


Note 


Translations in Hyp mode are always performed with the Long-descriptor translation table format. 
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A5.5 MMU memory accesses 


During a translation table walk, the MMU generates accesses. This section describes the specific 
behaviors of the core for MMU memory accesses. 


A5.5.1 Configuring MMU accesses 


Translation table walk can be performed in cacheable or non-cacheable regions. This is determined by 
the translation table walk memory attribute, which can be affected by several different configurations: 


¢ IRGN and ORGN bits in the TCR_ELx and VTCR_EL2 registers (or TTBRO/TTBR1_ELx register 
for short-descriptor translation table format), which define the memory type for translation table 
walk. 

¢ SCTRL_ELx.C and HCR_EL2.CD or HCR.CD, which affect the table walk to cacheable or non- 
cacheable memory. 

« Stage 2 memory attribute for stage | translation table walk, which affect the stage | translation table 
walk memory attribute. 


For more information on the control fields, see the Arm® Architecture Reference Manual Armv8, for 
Armv8-A architecture profile. 


Only when the final translation table walk memory attribute is inner write-back and outer write-back and 
the cache is enabled, the translation table walk accesses the cacheable memory. 


A5.5.2 Hardware management of the Access flag and dirty state 


The Cortex-A55 core includes the option to perform hardware updates to the translation tables in 
AArch64 state only. 


These features are enabled in registers TCR_ELx and VTCR_EL2. To support the hardware management 
of dirty state, the DBM field is added to the translation table descriptors as part of Armv8.1-A 
architecture. 


The core supports hardware updates to the Access flag and to dirty state only when the translation tables 
are held in Inner Write-Back, Outer Write-Back Normal memory regions. 


If software requests a hardware update in a region that is not Inner Write-Back or Outer Write-Back 
Normal memory, then the core returns an abort with the following encoding: 


¢ ESR.ELx.DFSC = @b110001 for Data Aborts in AArch64. 
¢ ESR.ELx.IFSC = @b110001 for Instruction Aborts in AArch64. 


For the Cortex-A55 core, the following situations can cause hardware updates to the Access flag or to 
dirty state: 
¢ For a Store-Exclusive instruction to a memory location for which the DBM bit is | and the stage 1 
AP[2] bit is 1, if the Store-Exclusive fails because the exclusive monitor is not in the exclusive state, 
the AP[2] bit in the translation table is updated. 
¢ Fora Store-Exclusive instruction to a memory location for which the DBM bit is 1, and the stage 2 
S2AP[1] bit is 0, if the Store-Exclusive fails because the exclusive monitor is not in the exclusive 
state, the S2AP[1] bit in the translation table is updated. 
¢ Fora store to a memory location for which the DBM bit is 1, and the stage 1 AP[2] bit is 1, the AP[2] 
bit in the translation table is updated: 
— Ifthe memory location generates a synchronous external abort on a write for a store to a memory 
location. 
— Ifthe memory location generates a watchpoint on a write. 
¢ Fora store to a memory location for which the DBM bit is 1, and the stage 2 S2AP[1] bit is 0, the 
S2AP[1] bit in the translation table is updated: 
— Ifthe memory location generates a synchronous external abort on a write for a store to a memory 
location. 
— Ifthe memory location generates a watchpoint on a write. 
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¢ For aCAS or CASP instruction to a memory location for which the DBM bit is 1, and the stage 1 
AP[2] bit is 1, if the compare fails, and the location is not updated, the AP[2] bit in the translation 
table is updated. 

¢ ForaCAS or CASP instruction to a memory location for which the DBM bit is 1, and the stage 2 
S2AP[1] bit is 0, if the compare fails, and the location is not updated, the S2AP[1] bit in the 
translation table is updated. 


For more information about hardware updates of the Access flag and dirty state, see the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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A5.6 Responses 


Certain faults and aborts can cause an exception to be taken because of a memory access. 


A5.6.1 MMU responses 
When one of the following translations is completed, the MMU generates a response to the requester: 


¢ AnLtI TLB hit. 
© AnL2 TLB hit. 
¢ A translation table walk. 


The response from the MMU contains the following information: 

¢ The PA corresponding to the translation. 

¢ A set of permissions. 

¢ Domains information for AArch32 short descriptor format only. 

* Secure or Non-secure. 

¢ All the information required to report aborts. See the Arm® Architecture Reference Manual Armvé, for 
Armv8-A architecture profile for more details. 


A5.6.2 MMU aborts 


The MMU can detect faults that are related to address translation and can cause exceptions to be taken to 
the processing element. Faults can include address size, translation, access flags, and permissions. 


See the Arm® Architecture Reference Manual Armv&, for Armv8-A architecture profile for more 
information about aborts. 


A5.6.3 External aborts 


External aborts are aborts that occur in the memory system rather than aborts that the MMU detects. 
Normally, external memory aborts are rare. External aborts are caused by errors flagged by the external 
memory interfaces or are generated because of an uncorrected ECC error in the L1 data cache or L2 
cache arrays. 


When an external abort to the external interface occurs on an access for a translation table walk access, 

the MMU returns a synchronous external abort. For a Load Multiple or a Store Multiple operation, the 

address captured in the fault register is that of the address that generated the synchronous external abort. 
A5.6.4 Mis-programming contiguous hints 

A programmer might mis-program the translation tables so that: 


¢ The block size being used to translate the address is larger than the size of the input address. 
¢ The address range translated by a set of blocks marked as contiguous, by use of the contiguous bit, is 
larger than the size of the input address. 


If there is this kind of mis-programming, the Cortex-A55 core does not generate a translation fault. 


A5.6.5 Conflict aborts 


Conflict aborts are generated from the L1 TLB. Ifa conflict abort is detected in the L2 TLB, it will 
choose one valid translation it will not generate a conflict abort. 


See also the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for more 
information. 

A5.6.6 Memory Behavior 
The Cortex-A55 core supports all the Armv8-A memory types. 


However, the following behaviors are simplified and so for best performance their use is not 
recommended: 
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Write-Through Memory that is marked as Write-Through cannot be cached on the data-side and does 
not make coherency requests. On the instruction-side, areas that are marked as Write- 
Through and Write-Back can be cached in the L1 instruction cache. However, only 
areas marked as Write-Back can be cached in the L2 cache or the L3 cache. 


Mixed inner Memory that is not marked as inner and outer Write-Back cannot be cached on the 
and outer data-side and does not make coherency requests. This applies to the memory type 
cacheability only, and not to the allocation hints. All caches within the cluster are treated as being 


part of the inner cacheability domain. 


For more information on supported memory behaviors, see the Arm® Architecture Reference Manual 
Armv6, for Armv8-A architecture profile 


A5.6.7 Support for Arm®v8-A device memory types 


The Armv8-A architecture includes memory types that replace the Armv7 Device and Strongly-ordered 
memory types. These device memory types have the following three attributes: 


G — Gathering 
The capability to gather and merge requests together into a single transaction. 


R — Reordering 
The capability to reorder transactions. 


E - Early Write Acknowledgement 
The capability to accept early acknowledge of transactions from the interconnect. 


The legal combinations are described in the following table: 


Table A5-3 Armv8-A Device Memory Types 


























Memory type | Cortex-A55 | Comment 
support 
GRE Yes Similar to Normal non-cacheable, but does not permit speculative accesses. 
nGRE Yes Transactions might be reordered within the L3 memory system, or in the system interconnect. 
nGnRE Yes Corresponds to Device in Armv7. 
nGnRnE Yes Corresponds to Strongly Ordered in Armv7. 
Treated the same as nGnRE inside the Cortex-A55 core, but reported differently on the bus interface. 








For more information, see the Arm® Architecture Reference Manual Armv8&, for Armv8-A architecture 
profile. 
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A5.7 Page Based Hardware Attributes 


PBHA is an optional, implementation defined feature. 


It allows software to set up to two bits in the translation tables, which are then propagated though the 
memory system with transactions, and can be used in the system to control system components. The 
meaning of the bits is specific to the system design. 


For information on how to set and enable the PBHA bits in the translation tables, see the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. When disabled, the PBHA 
value that is propagated on the bus is 0. 


For memory accesses caused by a translation table walk, the AHTCR, ATTBCR, and AVTCR registers 
control the PBHA values. 

PBHA combination between stage 1 and stage 2 on memory accesses 

PBHA should always be considered as an attribute of the physical address. 


When stage | and stage 2 are enabled: 

¢ If both stage | PBHA and stage 2 PBHA are enabled, the final PBHA is stage 2 PBHA. 

¢ Ifstage 1 PBHA is enabled and stage 2 PBHA is disabled, the final PBHA is stage 1 PBHA. 
¢ Ifstage 1 PBHA is disabled and stage 2 PBHA is enabled, the final PBHA is stage 2 PBHA. 
¢ If both stage | PBHA and stage 2 PBHA are disabled, the final PBHA is defined to 0. 


Enable of PBHA has granularity of one bit, so this property is applied independently on each PBHA bit. 


Mismatched aliases 


If the same physical address is accessed through more than one virtual address mapping, and the PBHA 
bits are different in the mappings, then the results are UNPREDICTABLE. The PBHA value sent on the bus 
could be for either mapping. 
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Chapter A6 
Level 1 memory system 


This chapter describes the L1 instruction cache and data cache that make up the LI memory system. 


It contains the following sections: 

¢ A6.1 About the LI memory system on page A6-74. 

¢ A6.2 Cache behavior on page A6-75. 

¢ A6.3 L1 instruction memory system on page A6-78. 

¢ A6.4L1 data memory system on page A6-80. 

¢ A6.5 Data prefetching on page A6-83. 

¢ A6.6 Direct access to internal memory on page A6-84. 
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A6.1 About the L1 memory system 
The Ll memory system enhances the performance and power efficiency in the Cortex-A55 core. 


It consists of separate instruction and data caches. You can configure instruction and data caches 
independently during implementation to sizes of 16KB, 32KB, or 64KB. 


L1 instruction-side memory system 

The L1 instruction-side memory system provides an instruction stream to the DPU. Its key features are: 
* 64-byte instruction side cache line length. 

¢ 4-way set associative L1 instruction cache. 

¢ 128-bit read interface to the L2 memory system. 


The Cortex-A55 core uses extensive branch prediction to improve Jnstructions Per Clock (IPC) and 
power efficiency. 


L1 data-side memory system 

The L1 data-side memory system responds to load and store requests from the DPU. It also responds to 

SCU snoop requests from other cores, or external masters. Its key features are: 

* 64-byte data side cache line length. 

¢ 4-way set associative L1 data cache. 

¢ Read buffer that services both the Data Cache Unit (DCU), and the Instruction Fetch Unit (IFU). 

* 64-bit read path from the data L1 memory system to the datapath. 

¢ 128-bit write path from the datapath to the L1 memory system. 

¢ Merging store buffer capability which writes to all types of memory (device, normal cacheable and 
normal non-cacheable). 

¢ Data side prefetch engine that detects patterns of strides with multiple streams are allowed in parallel, 
capable of detecting both constant and patterns of strides. 
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A6.2 Cache behavior 


On a cache miss, the cache performs a critical word-first fill. 


This word-first fill is an implementation-specific feature of the instruction and data caches. 


A6.2.1 Instruction cache disabled behavior 


If the instruction cache is disabled, all instruction fetches to cacheable memory are treated as if they were 
non-cacheable. 


This means that instruction fetches might not be coherent with caches in other cores, and software must 

take account of this. 

¢ In AArché6é4 state, lines may still be allocated into the instruction cache even if the memory is marked 
non-cacheable or the instruction cache is disabled. See the Arm® Architecture Reference Manual 
Armvé8, for Armv8-A architecture profile for more information. 

¢« In AArch32 state, lines are not allocated into instruction cache when the instruction cache is disabled. 
Allocation into the instruction cache only occurs when the instruction cache is enabled, and memory 
is marked as Write-Back or Write-Through cacheable. 


A6.2.2 Instruction cache speculative memory accesses 


Instruction fetches are speculative, as there can be several unresolved branches in the pipeline. There is 
no execution guarantee. 


A branch instruction or exception in the code stream can cause a pipeline flush, discarding the currently 
fetched instructions. On instruction fetch accesses, pages with Device memory type attributes are treated 
as Non-Cacheable Normal Memory. 


Device memory pages must be marked with the translation table descriptor attribute bit Execute Never 
(XN). The device and code address spaces must be separated in the physical memory map. This 
separation prevents speculative fetches to read-sensitive devices when address translation is disabled. 


If the instruction cache is enabled, and if the instruction fetches miss in the L1 instruction cache, they can 
still look up in the L1 data caches. However, a new line is not allocated in the data cache unless the data 
cache is enabled. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for more 
information. 


A6.2.3 Data cache disabled behavior 


If the SCTLR.C bit is set to 0, load and store instructions do not access any of the L1 data, L2, or DSU 
L3 caches. 


The SCTLR.C bit controls whether accesses from the core can look up and allocate into the data cache 
and unified L2 or L3 caches. Data cache maintenance operations execute normally, regardless of how the 
SCTLR.C bit is set. 


If the SCTLR.C bit is set to 0, then the following apply: 
¢ Instruction fetches cannot allocate in the L2 or L3 caches. 
¢ All load and store instructions to cacheable memory are treated as if they were non-cacheable. 


Therefore, they are not coherent with the caches in this core or the caches in other cores, and software 
must take this into account. 


The L2 and L1 data caches cannot be disabled independently. 


A6.2.4 Data cache maintenance considerations 


DCIMVAC operations in AArch32 and DC IVAC instructions in AArch64 perform an invalidate of the 
target address. 


If the data is dirty, a clean is performed before the invalidate. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights A6-75 
reserved. 
Non-Confidential 


A6 Level 1 memory system 
A6.2 Cache behavior 


DCISW and DCCSW operations in AArch32 and DC ISW and DC CSW instructions in AArch64 
perform both a clean and invalidate of the target set/way. The values of HCR.SWIO and 
HCR_EL2.SWIO have no effect. 


A6.2.5 Data cache coherency 
The Cortex-A55 core uses the MESI protocol to maintain data coherency between multiple cores. 
MESI describes the state that a shareable line in a L1 data cache can be in: 
M Modified/UniqueDirty (UD). The line is in only this cache and is dirty. 
E_ Exclusive/UniqueClean (UC). The line is in only this cache and is clean. 


S  Shared/SharedClean (SC). The line is possibly in more than one cache and is clean. 
I Invalid//nvalid (1). The line is not in this cache. 


The DCU stores the MESI state of the cache line in the tag and dirty RAMs. 
Note 


The names UniqueDirty, SharedDirty, UniqueClean, SharedClean, and Invalid are the AMBA names for 
the cache states. The Cortex-A55 core does not use the SharedDirty AMBA state. 





A6.2.6 Write Streaming Mode 
A cache line is allocated to the L1 on either a read miss or a write miss. 


However, there are some situations where allocating on writes is not required. For example, when 
executing the C standard library memset () function to clear a large block of memory to a known value. 
Writes of large blocks of data can pollute the cache with unnecessary data. It can also waste power and 
performance if a linefill must be performed only to discard the linefill data because the entire line was 
subsequently written by the memset(). 


To counter this, the BIU includes logic to detect when the core has written a full cache line before the 
linefill completes. If this situation is detected on a configurable number of consecutive linefills, then it 
switches into write streaming mode. This is sometimes referred to as read allocate mode. 


When in write streaming mode, loads will behave as normal, and can still cause linefills, and writes will 
still lookup in the cache, but if they miss then they will write out to L2 (or possibly L3) rather than 
starting a linefill. 


Note 
More than the specified number of linefills might be observed on the ACE or CHI master interface, 


before the BIU detects that three full cache lines have been written and switches to write streaming 
mode. 








The BIU continues in write streaming mode until it detects either a cacheable write burst that is not a full 
cache line, or there is a load from the same line as is currently being written to L2. 


When a core has dropped into write streaming mode, the BIU continues to monitor the bus traffic and 
will signal to the L2 for it to go into write streaming mode when a further number of full cache line 
writes are seen. 


AArch64 state 
¢ CPUECTLR_EL1.L1WSCTL configures the L1 write streaming mode threshold. 
¢ CPUECTLR_EL1.L2WSCTL configures the L2 write streaming mode threshold. 
* CPUECTLR_EL1.L3WSCTL configures the L3 write streaming mode threshold. 


For more information, see B2.30 CPUECTLR_EL1, CPU Extended Control Register, EL1 
on page B2-340. 
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AArch32 state 
CPUECTLR.LIWSCTL configures the L1 write streaming mode threshold, 
CPUECTLR.L2WSCTL configures the L2 write streaming mode threshold, and 
CPUECTLR.L3WSCTL configures the L3 write streaming mode threshold. 


A6.2.7 Data cache invalidate on reset 
The Armv8-A architecture does not support an operation to invalidate the entire data cache. 


The Cortex-A55 core automatically invalidates caches on reset unless suppressed with the debug 
recovery P-channel state. It is therefore not necessary for software to invalidate the caches on startup. 


Related reference 

B2.77 ID_MMFR3_EL1, AArch32 Memory Model Feature Register 3, ELI on page B2-415 
Related reference 

B2.94 SCTLR_EL1, System Control Register, ELI on page B2-439 

B2.28 CPUACTLR_EL1, CPU Auxiliary Control Register, EL1 on page B2-336 
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A6.3 L1 instruction memory system 
The L1 instruction side memory system provides an instruction stream to the Data Processing Unit 
(DPU). 
To increase overall performance and to reduce power consumption, it uses: 
¢ Dynamic branch prediction. 
¢ Instruction caching. 
A6.3.1 Program flow prediction 
The Cortex-A55 core contains program flow prediction hardware, also known as branch prediction. 
Branch prediction increases overall performance and reduces power consumption. With program flow 
prediction disabled, all taken branches incur a penalty that is associated with flushing the pipeline. 
To avoid this penalty, the branch prediction hardware predicts if a conditional or unconditional branch is 
to be taken. For conditional branches, the hardware predicts if the branch is to be taken. It also predicts 
the address that the branch goes to, known as the branch target address. For unconditional branches, only 
the target is predicted. 
The hardware contains the following functionality: 
¢ A BTAC holding the branch target address of previously taken branches. 
¢ Dynamic branch predictor history. 
¢ The return stack, a stack of nested subroutine return addresses. 
¢ A static branch predictor. 
« An indirect branch predictor. 
Predicted and non-predicted instructions 
Unless otherwise specified, the following list applies to A64, A32, and T32 instructions. As a rule the 
flow prediction hardware predicts all branch instructions regardless of the addressing mode, and 
includes: 
¢ Conditional branches. 
¢ Unconditional branches. 
¢ Indirect branches that are associated with procedure call and return instructions. 
¢ Branches that switch between A32 and T32 states. 
The following branch instructions are not predicted: 
¢ Data-processing instructions using the PC as a destination register. 
¢ The BX instruction. 
¢ Exception returm instructions. 
T32 state conditional branches 
A T32 unconditional branch instruction can be made conditional by inclusion in an Jf-Then (IT) block. It 
is then treated as a conditional branch. 
Return stack 
The return stack stores the address and instruction set state. 
This address is equal to the link register value stored in R14 in AArch32 state or X30 in AArch64 state. 
The following instructions cause a return stack push if predicted: 
¢ BL ri14 
* BLX (immediate) in AArch32 state 
* BLX (register) in AArch32 state 
* BLR in AArch64 state 
¢ MOV pc,ri4 
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In AArch32 state, the following instructions cause a return stack pop if predicted: 
° BX 

e LDR pc, [r13], #imm 

¢ LDM r13, {...pc} 

¢ LDM r13, {...pc} 


In AArch64 state, the RET instruction causes a return stack pop. 


As exception return instructions can change core privilege mode and security state, they are not 
predicted. These include: 


¢ LDM (exception return) 





° RFE 
¢ SUBS pc, Ir 
¢  ERET 
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L1 data memory system 


The L1 data cache is organized as a Virtually Indexed Physically Tagged (VIPT) cache, with alias 
avoidance logic so that it appears to software as if it were physically indexed. 


The Armv8-A architecture does not support an operation to invalidate the entire data cache. If software 
requires this function, it must be constructed by iterating over the cache geometry and executing a series 
of individual invalidate by set/way instructions. 


Memory system implementation 


This section describes the implementation of the L1 memory system. 


Limited Order Regions 


The Cortex-A55 core supports a single limited order range that includes the entire memory space. 


Atomic instructions 
The Cortex-A55 core supports the atomic instructions added in the Armv8.1-A architecture. 


Atomic instructions to cacheable memory can be performed as either near atomics or far atomics, 
depending on where the cache line containing the data resides. If the instruction hits in the L1 data cache 
in a unique state then it will be performed as a near atomic in the L1 memory system. If the atomic 
operation misses in the L1 cache, or the line is shared with another core then the atomic is sent as a far 
atomic out to the L3 cache. If the operation misses everywhere within the cluster, and the master 
interface is configured as CHI, and the interconnect supports far atomics, then the atomic will be passed 
on to the interconnect to perform the operation. If the operation hits anywhere inside the cluster, or the 
interconnect does not support atomics, then the L3 memory system will perform the atomic operation 
and allocate the line into the L3 cache if it is not already there. 


The Cortex-A55 core supports atomics to device or non-cacheable memory, however this relies on the 
interconnect also supporting atomics. If such an atomic instruction is executed when the interconnect 
does not support them, it will result in a synchronous Data Abort (for load atomics) or an asynchronous 
Data Abort (for store atomics). The behavior of the atomic instructions can be modified by the 
CPUECTLR register settings. 


For more information on the CPUECTLR register, see B2.30 CPUECTLR_ELI, CPU Extended Control 
Register, EL1 on page B2-340. 


LDAPR instructions 


The core supports Load acquire instructions adhering to the RCpc consistency semantic introduced in the 
Armv8.3-A extensions. This is reflected in register ID AA64ISARI_EL1 where bits[23:20] are set to 
@beG@1 to indicate that the core supports LDAPRB, LDAPRH, and LDAPR instructions implemented in 
AArché64. 


For more information on the ID AA64ISAR1 ELI register, see 82.58 ID _AA64ISARO_ELI, AArch64 
Instruction Set Attribute Register 0, ELI on page B2-382. 


Transient memory region 


The core has a specific behavior for memory regions that are marked as Write-Back cacheable and 
transient, as defined in the Armv8-A architecture. 


For any load that is targeted at a memory region that is marked as transient, the following occurs: 

¢ Ifthe memory access misses in the L1 data cache, the returned cache line is allocated in the L1 data 
cache but is marked as transient. 

* On eviction, if the line is clean and marked as transient, it is not allocated into the L2 cache but is 
marked as invalid. 
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For stores that are targeted at a memory region that is marked as transient, if the store misses in the L1 
data cache, the line is allocated into the L2 cache. 


Non-temporal loads 


Non-temporal loads indicate to the caches that the data is likely to be used for only short periods. For 
example, when streaming single-use read data that is then discarded. In addition to non-temporal loads, 
there are also prefetch-memory (PRFM) hint instructions with the STRM qualifier. 


Non-temporal loads cause allocation into the L1 data cache, with the same performance as normal loads. 
However, when a later linefill is allocated into the cache, the cacheline marked as non-temporal has 
higher priority to be be replaced. To prevent pollution of the L2 cache, a non-temporal line that is evicted 
from LI, is not allocated to L2 as would happen for a normal line. 


Note 


The line is only marked as non-temporal in the cache if the core has the line in a unique state. If shared 
with other cores, the line is treated normally. 





Non-temporal stores are treated the same as stores to a memory region that is marked as transient. 


A6.4.2 Internal exclusive monitor 
The Cortex-A55 core L1 memory system has an internal exclusive monitor. 


This monitor is a 2-state, open and exclusive, state machine that manages Load-Exclusive or Store- 
Exclusive accesses and Clear-Exclusive (CLREX) instructions. You can use these instructions to construct 
semaphores, ensuring synchronization between different processes running on the core, and also between 
different cores that are using the same coherent memory locations for the semaphore. A Load-Exclusive 
instruction tags a small block of memory for exclusive access. CTR.ERG defines the size of the tagged 
block as 16 words, one cache line. 


Note 


A load/store exclusive instruction is any one of the following: 

¢ In the A64 instruction set, any instruction that has a mnemonic starting with LDX, LDAX, STX, or STLX. 

¢ Inthe A32 and T32 instruction sets, any instruction that has a mnemonic starting with LDREX, STREX, 
LDAEX, or STLEX. 








If a Load-Exclusive instruction is performed to non-cacheable or device memory, and is to a region of 
memory in the SoC that does not support exclusive accesses, it causes a Data Abort exception with a 
Data Fault Status Code of either: 

* @b110101, when using the long descriptor format. 

* @b10101, when using the short descriptor format. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for more 
information about these instructions. 


Treatment of intervening STR operations 


Where there is an intervening store operation between an exclusive load and an exclusive store from the 
same core, the intermediate store does not produce any direct effect on the internal exclusive monitor. 


After the exclusive load, the local monitor is in the Exclusive Access state. It remains in the Exclusive 
Access state after the store, and then returns to the Open Access state only after an exclusive store, a 
CLREX instruction, or an exception return. 


However, if the exclusive code sequence accessed address is in cacheable memory, any eviction of the 
cache line containing that address clears the monitor. Arm recommends that no load or store instructions 
are placed between the exclusive load and the exclusive store, because these additional instructions can 
cause a cache eviction. Any data cache maintenance instruction can also clear the exclusive monitor. 
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A6.4.3 Exclusive monitor 
In the exclusive state machine, the IMPLEMENTATION DEFINED transitions are as follows: 


¢ Ifthe monitor is in the exclusive state, and a store exclusive is performed to a different address, then 
the store exclusive fails and does not update memory. 

¢ Ifanormal store is performed to a different address, it does not affect the exclusive monitor. 

¢ Ifanormal store is performed from a different core to the same address it clears the exclusive 
monitor. If the store is from the same core then it does not clear the monitor. 
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A6.5 Data prefetching 


The following section describes the software and hardware data prefetching behavior of the Cortex-A55 
core. 


Hardware data prefetcher 


The Cortex-A55 core has a data prefetch mechanism that looks for cache line fetches with regular 
patterns. If the data prefetcher detects a pattern, then it signals to the memory system that memory 
accesses from a specified address are likely to occur soon. The memory system responds by starting new 
linefills to fetch the predicted addresses ahead of the demand loads. 


The Cortex-A55 core can track multiple streams in parallel. 
Prefetch streams end when either: 


¢ The pattern is broken. 

¢ A DSB is executed. 

¢ A WFI or WFE is executed. 

« A data cache maintenance operation is executed. 


For read streams, the prefetcher is based on the virtual addresses. A given stream is allowed to prefetch 
addresses through multiple pages as long as they are cacheable and with read permissions. If the new 
page is still cacheable and has read permission, it can cross page boundaries. Write streams are based on 
physical addresses and so cannot cross page boundaries. However, if full cache line writes are performed 
then the prefetcher does not activate and write streaming mode is used instead. 


For some types of pattern, when the prefetcher is confident in the stream, it can start progressively 
increasing the prefetch distance ahead of the current accesses. These accesses start to allocate to the L3 
cache rather than L1. Allocating to the L3 cache allows better utilization of the larger resources available 
at L3. Also, utilizing the L3 cache reduces the amount of pollution of the L1 cache if the stream ends or 
is incorrectly predicted. If the prefetching to L3 was accurate, the line will be removed from L3 and 
allocated to L1 when the stream reaches that address. 


The CPUECTLR register allows you to: 
¢ Deactivate the prefetcher. 
¢ Alter the number of outstanding requests that the prefetcher can make. 


Preload instructions 


The Cortex-A55 core supports PLD and PRFM instructions. If PLD and PRFM miss and are to a cacheable 
address, then these instructions perform a lookup in the cache and start a linefill. The PRFMs also enables 
targeting of a prefetch to the L2 or L3 cache. A request is sent to L2 to start a linefill, and then the 
instruction can retire without any data being returned to L1. PLI, PLIL1KEEP, and PLIL1STRM are 
implemented as a prefetch to L2. 


Use the PLD or PRFM instruction for data prefetching where short sequences or irregular pattern fetches 
are required. For more information about prefetch memory and preloading caches, see the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


Data Cache Zero 


The Data Cache Zero by Virtual Address (DC ZVA) instruction enables a block of 64-bytes in memory, 
which is aligned to 64-bytes in size, to be set to 0. The DCZID_ELDO register passes this value. 


The DC ZVA instruction allocates this value into the data cache using the same method as a normal store 
instruction. 


Related reference 
B2.28 CPUACTLR_ELI, CPU Auxiliary Control Register, EL1 on page B2-336 
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Direct access to internal memory 


The Cortex-A55 core provides a mechanism to read the internal memory that is used by the L1 cache and 
TLB structures through implementation defined system registers. This functionality can be useful when 
investigating issues where the coherency between the data in the cache and data in system memory is 
broken. 


When the core executes in AArch64 state, the appropriate memory block and location are selected using 
several write-only registers. The data is read from read-only registers as shown in the following table. 
These operations are available only in EL3. In all other modes, executing these instructions results in an 


Undefined Instruction exception. 


Table A6-1 AArch64 registers used to access internal memory 
































Register name | Function Access_ | Operation Rd Data 
CDBGDRO _EL3 | Data Register 0 Read-only |MRS <Xd>, S3_6_c15_c@_@| Data 
CDBGDRI1_EL3 | Data Register 1 Read-only |MRS <Xd>, S3_6_c15_c@_1/ Data 
CDBGDR2_EL3 | Data Register 2 Read-only |MRS <Xd>, S3_6_c15_c@_ 2) Data 
CDBGDCT_EL3 | Data Cache Tag Read Operation Register Write-only |MSR S1_6_c15_c2_0, <Xd>| Set/Way 
CDBGICT_EL3 | Instruction Cache Tag Read Operation Register | Write-only |MSR S1_6_c15_c2_1, <Xd> | Set/Way 
CDBGTT_EL3 | TLB Tag Read Operation Register Write-only |MSR S1_6_c15_c2_2, <Xd> | Index/Way 
CDBGDCD_EL3 | Data Cache Data Read Operation Register Write-only |MSR S1_6_c15_c4_@, <Xd> | Set/Way/Offset 
CDBGICD_EL3 | Instruction Cache Data Read Operation Register | Write-only |MSR S1_6_c15_c4_1, <Xd> | Set/Way/Offset 
CDBGTD_EL3 | TLB Data Read Operation Register Write-only |MSR S1_6_c15_c4_2, <Xd>J Index/Way 























When the core executes in AArch32 state, the appropriate memory block and location are selected using 
several write-only system registers. The data is read from read-only system registers as shown in the 
following table. These operations are available only in EL3. In all other modes, executing the system 
operation results in an Undefined Instruction exception. 


Table A6-2 AArch32 CP15 registers used to access internal memory 
























































Register name | Function Access_ | CP15 operation Rd Data 
CDBGDRO Data Register 0 Read-only |MRC p15, 6, <Rd>, c15, c@, @| Data 
CDBGDRI1 Data Register 1 Read-only |MRC p15, 6, <Rd>, c15, c@, 1/ Data 
CDBGDR2 Data Register 2 Read-only |MRC p15, 6, <Rd>, c15, cO@, 2) Data 
CDBGDCT Data Cache Tag Read Operation Register Write-only |MCR p15, 6, <Rd>, c15, c2, @| Set/Way 
CDBGICT Instruction Cache Tag Read Operation Write-only |MCR p15, 6, <Rd>, c15, c2, 1) Set/Way 
Register 
CDBGTT TLB Tag Read Operation Register Write-only |MCR p15, 6, <Rd>, c15, c2, 2] Index/Way 
CDBGDCD Data Cache Data Read Operation Register Write-only |MCR p15, 6, <Rd>, c15, c4, @| Set/Way/Offset 
CDBGICD Instruction Cache Data Read Operation Write-only |MCR p15, 6, <Rd>, c15, c4, 1] Set/Way/Offset 
Register 
CDBGTD TLB Data Read Operation Register Write-only |MCR p15, 6, <Rd>, c15, c4, 2 Index/Way 
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A6.6.1 Encoding for tag and data in the L1 data cache 
The Cortex-A55 L1 data cache is a 4-way set associative structure. 


The size of the configured cache determines the number of sets in each way. The following table shows 
the encoding (set in Rd in the appropriate MCR instruction) used to locate the cache data entry for tag and 
data memory. It is similar for both the tag and data RAM access. 


Data RAM access includes an extra field to locate the appropriate word in the cache line. The set-index 
range parameter (S) is: 


S=12 For a 16KB cache. 
S=13 For a 32KB cache. 
S=14 For a 64KB cache. 


Table A6-3 Cortex-A55 L1 Data Cache Tag and Data location encoding 




















Bitfield of Rd Description 

[31:30] Cache Way 

[29:S] Unused 

[S-1:6] Set index 

[5:3] Cache data element offset 
[2:0] Unused (Zero) 














Tag information (MESI state, outer attributes, and valid) for the selected cache line, returns using Data 
Register 0 and Data Register 1. 


Use the format that is shown in the following table. 


Table A6-4 Cortex-A55 L1 Data Cache Tag data format 


















































Bitfield of Data Description 
Register 0 and 1 
DR1[31:30] MESI State (from tag RAM): 
0b00 Invalid 
0b01 Shared 
0b10 Unique non-transient 
Ob11 Unique transient 
DR1[29] Non-secure state (NS) (from tag RAM) 
DR1[28:1] Tag Address [39:12] (from tag RAM) 
DR1[0] Unused (Zero) 
DRO[31:7] Unused (Zero) 
DRO[6:5] PBHA bits (from Dirty RAM) 
DRO[4] Dirty bit (from Dirty RAM) 
DRO[3] Shareability (from Dirty RAM) 
DRO[2:1] Age (from Dirty RAM) 
DRO[0] Outer Allocation Hint (from Dirty RAM) 
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The 64 bits of cache data returns in Data register 0 and Data register 1. 


A6.6.2 Encoding for tag and data in the L1 instruction cache 


The L1 instruction cache is different from the L1 data cache. This is shown in the encodings and data 
format used in the cache debug operations that are used to access the tag and data memories. 


The following table shows the encoding that is required to select a given cache line. 


The set-index range parameter (S) is: 


S=12 For a 16KB cache. 
S=13 For a 32KB cache. 
S=14 For a 64KB cache. 


Table A6-5 Cortex-A55 Instruction Cache Tag and Data location encoding 


























Bitfield of Rd Description 

[31:30] Cache Way 

[29:S] Unused 

[S-1:6] Set index 

[5:2] Cache data element offset (Data Register only) 
[1:0] Unused 








The following table shows the tag, instruction, and valid data for the selected cache line using only Data 
Register. 


Table A6-6 Cortex-A55 Instruction Cache Tag data format 
































Bitfield of Data Description 

Register 0 

[31] Unused 

[30:29] Valid and set mode: 
@bee A32 
@be1 T32 
@b10 A64 
@b11 Invalid 

[28] Non-secure state (NS) - 

[27:0] Tag address - 














The cache data RAMs store instructions in a pre-decoded format. Each A32 or A64 or 32-bit T32 
instruction is expanded to 40-bits and each 16-bit T32 instruction occupies 20 bits of the cache. The L1 
Instruction Cache Data Read Operation returns two 20-bit entries from the cache in Data Register 0 and 
Data Register 1. Each corresponds to the 16-bit aligned offset in the cache line: 


Data Register 0[19:0] 
Data Register 1[19:0] 


Pre-decode data from cache offset. 
Pre-decode data from cache offset +2. 


In A32 or A64 state, these two combined fields always represent a single pre-decoded instruction. In T32 
state, they can represent any combination of 16-bit and partial or full 32-bit instructions. 
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Encoding for the L2 TLB 


The Cortex-A55 core L2 TLB is built from a 4-way set associative RAM-based structure and contains 
the data for the main TLB RAM, the Walk cache and IPA cache. 


To read the individual entries into the data registers, software must write to the TLB Tag Read Operation 
Register and to the TLB Data Read Operation Register. 


Table A6-7 Cortex-A55 TLB Data Read Operation Register location encoding 





Bitfield of Rd 


Description 





[31:30] 


TLB Way 





[29:9] 


Unused 








[8:0] 





TLB index 








The TLB index is used to select the index from the TLB, walk cache, or IPA cache. 


Table A6-8 TLB index 





Bitfield of Rd 


Description 





0x00 -OFF 


Main TLB 





0x100-10F 


Walk cache 








0x110-11F 





IPA cache 








The TLB uses an encoding for the descriptor that is returned using the following Data Registers: 
Data Register 0[31:0] 
Data Register 1[31:0] 
Data Register 2[31:0] 


Main TLB RAM descriptor fields 


TLB Descriptor[3 1:0] 
TLB Descriptor[63:32] 
TLB Descriptor[88:64] 


The Main TLB RAM is divided into two parts, where one part for storing the tag and the other for 


storing the data. The following tables list the descriptor fields. 


Table A6-9 TLB descriptor fields for Tag RAM 





Field 


Bits 


Width 


Description 





Valid 


[0] 


Indicates that the entry is valid. 





NS (walk) 


[1] 


The security state of core. Used to compare with the NS state for TLB lookup entry match. 





ASID 


[17:2] 


Indicates the Address Space Identifier (ASID). This field will be 0 if ASID is not used. 





VMID 








[33:18] 








Indicates the virtual machine identifier. This field will be 0 if VMID is not used. 
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Table A6-9 TLB descriptor fields for Tag RAM (continued) 





Field Bits | Width | Description 





Size [36:34] | 3 Indicates the combined page size of stage 1 and stage 2. 


VMSAv8-32 Short-descriptor translation table format: 


ebeee 4KB 
0be10 64KB 
@b100 1MB 
0b110 16MB 


VMSAv8-32 Long-descriptor translation table format or VMSAv8-64 translation table when no 
16KB page granule is used: 


@be01 4KB 
0be11 64KB 
@b101 2MB 
@b111 512MB 


VMSAv8-64 translation table when 16KB page granule is used. 


The Domain[1] bit (bit[44]) is used together to encode the size information (Domain[1]:Size[2:0]): 








@beee1 4KB 
@bee11 64KB 
@be101 2MB 
0be0111 512MB 
@b1001 16KB 
@b1011 32MB 
nG [37] 1 Indicates the non-global bit. 
AP/HYP [40:38] | 3 AArch32: Access permissions from stage1 translation or select hypervisor mode flag. 


AArch64: Access permissions from stage | translation or select the EL2/EL3 flag. 















































S2AP [42:41] | 2 Indicates the stage2 permission for EL1/EL0. For EL2/EL3, S2AP[1] is for the stage! access 
permission and S2AP[0] is for identify EL2 or EL3. 

Domain [46:43] | 4 Indicates the Domain [3:0] information for VMSA and other control information for LPAE. 
S1 Size [49:47] | 3 Indicates the page or block size of the stage | translation result. 

Address Sign [50] 1 Indicates the VA sign bit, VA[48]. 

bit 

VA [78:51] | 28 Indicates the virtual address. 

DBM [79] 1 Indicates the Dirty Bit Modifier (DBM) bit. 

Parity [81:80] | 2 Indicates the parity bits. If parity is not configured, their bits are absent. 
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Table A6-10 TLB descriptor fields for Data RAM when PBHA is FALSE 




















































































































Field Bits | Width | Description 
XS1Usr [0] 1 AArch32: Executable and Readable in stage! user mode. 
AArch64: Executable in stagel user mode 
XS1Non-Usr {1] 1 AArch32 and AArch 64: Executable in stage 1 non-user mode. 
XS2Usr [2] 1 AArch32 and AArch 64: Executable in stage 2 user mode. 
XS2Non-Usr [3] 1 AArch32 and AArch 64: Executable in stage 2 non-user mode. 
Memory type and shareability | [11:4] | 8 Defines the memory attribute. 
S2 Level [13:12] | 2 The stage 2 level that gave this translation. 
NS (descriptor) [14] 1 The security state allocated to this memory region. 
PA [42:15] | 28 The physical address. 
Parity [43] 1 Parity inclusion is dependant on configuration. 
Table A6-11 TLB descriptor fields for Data RAM when PBHA is TRUE 
Field Bits | Width | Description 
XS1Usr [0] 1 AArch32: Executable and Readable in stage! user mode. 
AArch64: Executable in stage] user mode 
XS1Non-Usr [1] 1 AArch32 and AArch 64: Executable in stage 1 non-user mode. 
XS2Usr [2] 1 AArch32 and AArch 64: Executable in stage 2 user mode. 
XS2Non-Usr [3] 1 AArch32 and AArch 64: Executable in stage 2 non-user mode. 
Memory type and shareability | [11:4] | 8 Defines the memory attribute. 
PBHA bits [13:12] | 2 PBHA bits. 
S2 Level [15:14] | 2 The stage 2 level that gave this translation. 
NS (descriptor) [16] 1 The security state allocated to this memory region. 
PA [44:17] | 28 The physical address. 
Parity [45] 1 Parity inclusion is dependant on configuration. 
A6.6.5 Walk cache descriptor fields 
The following table shows the walk cache descriptor data fields for Tag and Data RAMs. 
Table A6-12 Walk cache descriptor fields for Tag RAM 
Field Bit Position | Width | Description 
Valid [0] 1 Indicates that the entry is valid 
NS (walk) [1] 1 The Security state of the entry fetch 
ASID [17:2] 16 Address Space Identifier 
VMID [33:18] 16 Virtual Machine Identifier 
HYP/EL2 [34] 1 Set if the entry was fetched in HYP, EL2, or Virtual Host Extension (VHE) mode. 
EL3 [35] 1 Set if the entry was fetched in AArch64 EL3 mode 
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Table A6-12 Walk cache descriptor fields for Tag RAM (continued) 






















































































Field Bit Position | Width | Description 
Arch [38:36] 3 Used to determine how many and which bits of address are used for constructing the 
physical address of the pagewalk 
Domain [42:39] 4 Valid only if the entry was fetched in VMSAv7 format 
Address Sign Bit | [45] 1 Address sign bit, VA[48] 
VA [69:46] 24 Virtual Address sign bit 
S2AP [71:70] 2 Stage 2 access permission 
S2level [73:72] 2 The stage 2 level which translates the IPA to PA for the page table entry 
Parity [81:80] 2 Parity Bits 
Table A6-13 Walk cache descriptor fields for Data RAM 
Field Bit Position | Width | Description 
APTable | [1:0] 2 Combined ATable bits from stage 1 descriptors up to the last level 
XNTable | [2] 1 Combined XNTAbIle bits from stage 1 descriptors up to the last level 
PXNTable | [3] 1 Combined PXNTable bits from stage 1 descriptors up to the last level 
NSTable | [4] 1 Combined NSTable bits from first and second-level stage 1 tables or NS descriptors (VMSA) 
Attrs [12:5] 8 Physical address attributes of the final level stage 1 table 
PA [42:13] 30 Physical address of the stage | last translation level page table entry 
Parity [43] 1 Parity inclusion is core configuration dependent. If parity is not configured, these bits are absent. 
A6.6.6 IPA cache descriptor fields 


The IPA cache holds mappings from intermediate physical addresses (IPA) to physical addresses. It is 
only used for translations performed in non-secure ELO/1. It is updated whenever a stage 2 translation is 
completed, and checked whenever a stage 2 translation is required. 


The following table shows the data and tag fields in the IPA cache descriptor. 


Table A6-14 IPA cache descriptor fields for Tag RAM 



































Fields Bits Width | Descriptor 

Valid [0] 1 Indicates that the entry is valid. 

Entry granule | [2:1] | 2 Indicates the entry granule size. 

Unused [4:3] 2 Must be set to 0. 

Size [8:5] 4 Indicates the S2 page size for this entry. 
DBM [9] 1 Indicates the DBM. 

Unused [17:10] | 8 Must be set to 0. 

VMID [33:18] | 16 Indicates the virtual machine identifier. 

IPA [57:34] | 24 Unused lower bits, page size dependant, must be set to zero. 
Unused [79:59] | 22 Must be set to zero. 

Parity [81:80] | 2 If parity is not configured, this bit is absent. 
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Table A6-15 IPA cache descriptor fields for Data RAM 












































Fields | Bits Width | Descriptor 

SH [1:0] 2 Shareability. 

S2AP (3:2 2 Stage 2 access permissions 

XN [5:4] |2 Controls EL1 and ELO access permissions. 

Memattrs | [9:6] 4 Stage 2 memory attributes. 

PA [37:10] | 28 Physical Address. 

Unused | [42:38] | 5 Must be set to zero. 

Parity [43] 1 If parity is not configured, this bit is absent. 
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Level 2 memory system 


This chapter describes the L2 memory system. 


It contains the following sections: 

¢ A7.1 About the L2 memory system on page A7-94. 
¢ A7.2 Optional integrated L2 cache on page A7-95S. 
¢ A7.3 Support for memory types on page A7-96. 
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A7.1 About the L2 memory system 


The Cortex-A55 L2 memory system is required to interface the Cortex-A55 cores to the L3 memory 
system. 


The L2 cache controller handles requests from the L1 instruction and data caches, and snoop requests 
from the L3 memory system. The L2 memory system forwards responses from the L3 system to the core, 
which can then take precise or imprecise aborts, depending on the type of transaction. 


The L2 memory subsystem consists of: 


¢ An optional 4-way, set-associative L2 cache with a configurable size of 64KB, 128KB, or 256KB. 
Cache lines have a fixed length of 64 bytes. 
¢ Optional ECC protection for tag, data, and L2 data buffer RAM structures. 


The main features of the L2 memory system are: 
¢ Strictly exclusive with L1 data cache. 

¢ Pseudo-inclusive with L1 instruction cache. 
¢ Private per-core unified L2 cache. 

¢ 40-bit physical address space. 

¢ Physically indexed, physically tagged. 
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A7.2 Optional integrated L2 cache 


Data is allocated to the L2 cache only when evicted from the LI memory system, not when first fetched 
from the system. 


The exceptions to this rule are: 

¢ Ifthe Read-Allocate hint is set, cacheable reads from the TLB or instruction side are allocated in the 
L2 cache. 

¢ Ifthe Write-Allocate hint is set when the L1 enters write-streaming mode, cacheable writes are 
allocated in the L2 until the L2 streaming threshold is reached. 

¢ 2 prefetches issued by the L1 through a PLD or PRFM instruction are allocated in the L2 regardless of 
the read-allocate hint. 


When non-temporal data is evicted from the L1 memory system, the data is sent directly to L3 and is not 
allocated in L2. 


L2 RAMs are invalidated automatically at reset unless the debug recovery P-Channel state is used. 
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A7.3 Support for memory types 
The Cortex-A55 core simplifies the coherency logic by downgrading some memory types. 


¢« Memory that is marked as both Inner Write-Back Cacheable and Outer Write-Back Cacheable is 
cached in the L1 data cache and the L2 cache. 
¢ All other memory types are Non-cacheable. 


The additional attribute hints are used as follows: 


Allocation hint 
Determines the rules of allocation of newly fetched lines in the system, see A 7.2 Optional 
integrated L2 cache on page A7-95. 


Transient hint 


Allocating reads to the L1 data cache that have the transient bit set are allocated in the L1 cache 
and marked as most likely to be evicted according to the L1 eviction policy. 


Writes that have the transient bit set are not allocated to the L1 cache but are allocated to the L2 
cache instead. 


Evictions from L1 cache marked as transient are not allocated in L2 cache. 


The standard CHI attributes are passed to DSU with no modifications (except for translating architectural 

attributes to CHI attributes): 

¢ Allocate hint. 

¢ Cacheability (inner and outer are merged together, as the Cortex-A55 core only allocates both inner 
and outer cacheable memory). 

¢ Shareability. 
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Reliability, Availability, and Serviceability (RAS) 


This chapter describes the RAS features implemented in the Cortex-A55 core. 


It contains the following sections: 

¢ A8.1 Cache ECC and parity on page A8-98. 

¢ A8.2 Cache protection behavior on page A8-99. 

¢ A8.3 Uncorrected errors and data poisoning on page A8-101. 
¢ A8.4 RAS error types on page A8-102. 

¢ A8.5 Error synchronization barrier on page A8-104. 

¢ A&.6 Error reporting on page A8-105. 

¢ A&.7 Error injection on page A8-107. 
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A8.1 Cache ECC and parity 


The Cortex-A55 core implements the RAS extension to the Armv8-A architecture which provides 
mechanisms for standardized reporting of the errors generated by cache protection mechanisms. 


When configured with core cache protection, the Cortex-A55 core can detect and correct a 1-bit error in 
any RAM and detect 2-bit errors in some RAMs. 





Note 


For information about SCU-L3 cache protection, see the Arm® DynamIQ™ Shared Unit Technical 
Reference Manual. 





The RAS extension improves the system by reducing unplanned outages: 


¢ Transient errors can be detected and corrected before they cause application or system failure. 
¢ Failing components can be identified and replaced. 
¢ Failure can be predicted ahead of time to allow replacement during planned maintenance. 


Errors that are present but not detected are known as latent or undetected errors. A transaction carrying a 
latent error is corrupted. In a system with no error detection, all errors are latent errors and are silently 
propagated by components until either: 


¢ They are masked and do not affect the outcome of the system. These are benign or false errors. 
¢ They affect the service interface of the system and cause failure. These are silent data corruptions. 


The severity of a failure can range from minor to catastrophic. In many systems, data or service loss is 
regarded as more of a minor failure than data corruption, as long as backup data is available. 


The RAS extension focuses on errors that are produced from hardware faults, which fall into two main 
categories: 

¢ Transient faults. 

¢ Persistent faults. 


The RAS extension describes data corruption faults, which mostly occur in memories and on data links. 
RAS concepts can also be used for the management of other types of physical faults found in systems, 
such as lock-step errors, thermal trip, and mechanical failure. The RAS extension provides a common 
programmers model and mechanisms for fault handling and error recovery. 
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Cache protection behavior 


The core protects against soft errors that result ina RAM bitcell temporarily holding the incorrect value. 


The Cortex-A55 core writes a new value to the RAM to correct the error. If the error is a hard error that 
is not corrected by writing to the RAM, for example a physical defect in the RAM, then the core might 
get into a livelock as it continually detects and then tries to correct the error. 


Some RAMs have Single Error Detect (SED) capability, while others have Single Error Correct, Double 
Error Detect (SECDED) capability. The core can make progress and remain functionally correct when 
there is transient single bit error in any RAM. If there are multiple single bit errors in different RAMs, or 
within different protection granules within the same RAM, then the core also remains functionally 
correct. If there is a double bit error in a single RAM within the same protection granule, then the 
behavior depends on the RAM: 


¢ For RAMs with SECDED capability listed in the following table, the error is detected and reported as 
described in error reporting. If the error is in a cache line containing dirty data, then that data might 
be lost, resulting in data corruption 

¢ For RAMs with only SED, a double bit error is not detected and therefore might cause data 
corruption. 


If there are three or more bit errors, then depending on the RAM and the position of the errors within the 
RAM, the errors might be detected or might not be detected. 


The Cortex-A55 cache protection support has a minimal performance impact when no errors are present. 
When an error is detected, the access that caused the error is stalled while the correction takes place. 
When the correction is complete, the access either continues with the corrected data, or is retried. If the 
access is retried, it either hits in the cache again with the corrected data, or misses in the cache and re- 
fetches the data from a lower level cache or from main memory. The behavior for each RAM is shown in 
the following table. 


Table A8-1 Cache protection behavior 





RAM 


Protection type | Protection Correction behavior 


granule 





tag 


L1 instruction cache | Parity, SED 31 bits 


Both lines in the cache set are invalidated, then the line requested is 
refetched from L2 or external memory. 





data 


L1 instruction cache | Parity, SED 20 bits 


Both lines in the cache set are invalidated, then the line requested is 
refetched from L2 or external memory. 





L2 TLB tag 


Parity, SED 


39 bits or 40 bits 


Entry invalidated, new pagewalk started to refetch it. 





L2 TLB data 


Parity, SED 


43 bits 


Entry invalidated, new pagewalk started to refetch it. 





L1 data cache tag 


ECC, SECDED 


32 bits 


Line cleaned and invalidated from L1. SCU duplicate tags are used 
to get the correct address. Line refetched from L2 or external 
memory, with single bit errors corrected as part of the eviction. 





L1 data cache data 


ECC, SECDED 


32 bits 


Line cleaned and invalidated from L1, with single bit errors 
corrected as part of the eviction. Line refetched from L2 or external 
memory. 





L1 data cache dirty 


ECC, SECDED 


2 bits 


Line cleaned and invalidated from L1, with single bit errors 
corrected as part of the eviction. Only the dirty bit is protected. The 
other bits are performance hints, therefore do not cause a functional 
failure if they are incorrect. 








L2 cache tag 





ECC, SECDED 





30, 31, or 32 bits 
depending on the 
cache size. 





Tag rewritten with correct value, access retried. If the error is 
uncorrectable then the tag is invalidated. 
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Table A8-1 Cache protection behavior (continued) 





RAM Protection type | Protection Correction behavior 
granule 





L2 cache victim None - The victim RAM is used only as a performance hint. It does not 
result in a functional failure if the contents are incorrect. 





L2 cache data ECC, SECDED _| 64 bits Data is corrected inline, access might stall for an additional cycle or 
two while the correction takes place. 





L2 data buffer ECC, SECDED | 72 bits Data is corrected inline, access might stall for an additional cycle or 
two while the correction takes place. 





Branch predictor None - The branch predictor RAMs are used only as a performance hint. 

















They do not result in a functional failure if the contents are incorrect. 





Note 


When an ECC error occurs during a load instruction that takes multiple cycles to complete, for example 
LDM, the load instruction will re-execute. However, if a state change occurs between the original load 
instruction and the second attempt, then the second attempt will not execute. The first attempt could 
leave the register file in an inconsistent state, since the register file may have been updated for locations 
that did not have errors. 





The following situations will cause a state change between the original instruction and the second 

attempt: 

¢ A hardware breakpoint, watchpoint, or vector catch has been set since the first execution that is 
triggered on re-execution. 

¢ The page tables have been modified since the first execution, resulting in an instruction or data abort 
trap being taken on re-execution. 


In these situations, software may be able to observe that the original load instruction committed some 
new state despite not fully completing. 
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A8.3 Uncorrected errors and data poisoning 


When an error is detected, the correction mechanism is triggered. However, if the error is a 2-bit error in 
a RAM protected by ECC, then the error is not correctable. 


The behavior on an uncorrected error depends on the type of RAM. 


Uncorrected error detected in a data RAM 

When an uncorrected error is detected in a data RAM: 

¢ The chunk of data with the error is marked as poisoned. This poison information is then transferred 
with the data and stored in the cache if the data is allocated back into a cache. The poisoned data is 
stored per 64 bits of data, except in the L1 data cache where it is stored per 32 bits of data. 

¢ Ifthe interconnect supports poisoning, then the poison is passed along with the data when the line is 
evicted from the cluster. No abort is generated when a line is poisoned, as the abort can be deferred 
until the point when the poisoned data is consumed by a load or instruction fetch. 


Uncorrected error detected in a tag or dirty RAM 


When an uncorrected error is detected in a tag RAM or dirty RAM, either the address or coherency state 
of the line is not known anymore, and the data cannot be poisoned. In this case, the line is invalidated 
and an interrupt is generated to notify software that data has potentially been lost. 
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A8.4 RAS error types 


For a standard error record, three error types can be recorded. 


When a processing element accesses memory or other state, errors might be detected in that memory or 
state, and corrected, deferred, or signaled to the processing element as a detected error. The component 
that detects an error is called a node. 


Corrected error (CE) 


Deferred error (DE) 


Uncorrected Error (UC) 


An error was detected and corrected. It no longer infects the state of the node 
and has not been silently propagated. The node continues to operate. 


An error was detected, was not corrected, and was deferred. The error is not 
silently propagated and may be latent in the system. The node continues to 
operate. 


An error was detected and was not corrected or deferred. The error is latent 
in the system. 
Note 


Uncorrected errors can have subtypes depending on whether the error was 
produced or consumed at the node. 





Errors produced at the node 


For uncorrected errors that are produced at the node, the subtypes, in increasing severity, are: 


Latent 


Signaled 


Unrecoverable (UEU) 


Uncontainable (UC) 


The error has not been propagated. That is, the error was detected but not 
consumed, and was not recorded as a deferred error. 


The error has not been silently propagated. The error has been or might have 
been consumed, and was not recorded as a deferred error. 





Note 


The producer cannot know if a consumer has architecturally consumed the 
error. If it has definitely not been propagated to any consumer, and signaled 
otherwise, an error might be marked as Latent. 





The error has not been silently propagated. The node cannot continue 
operating. 

The error might have been silently propagated. If the error cannot be 
isolated, the system must be shut down to avoid catastrophic failure. 


Errors consumed at the node 


For uncorrected errors that are consumed at the node, the subtypes, in increasing severity, are: 


Restartable (UEO) 


Recoverable (UER) 


The error has not been silently propagated. The node halts operation because 
of consuming an error. The node does not rely on the corrupted data so can 
continue to operate without repairing the error. 


The error has not been silently propagated. The node halts operation. To 
continue, the node relies on consuming the corrupted data. If software can 
locate and repair the error, the halted operation can continue. 





Unrecoverable (UEU) The error has not been silently propagated. The node halts operation and 
cannot resume from its halted state. 
Uncontainable (UC) The error might have been silently propagated. If the error cannot be 
isolated, the system must be shut down to avoid catastrophic failure. 
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Error status priority 
The highest priority recorded error type is recorded in the Selected Error Record Primary Status Register. 


For more information, see 83.10 ERROSTATUS, Error Record Primary Status Register on page B3-481. 


Related reference 
B1.45 ERXSTATUS, Selected Error Record Primary Status Register on page B1-197 
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A8.5 Error synchronization barrier 
The Error Synchronization Barrier (ESB) instruction synchronizes unrecoverable errors. 


The RAS extension adds the ESB instruction used to synchronize unrecoverable errors. Unrecoverable 
errors are containable errors consumed by the core and not silently propagated. 


The ESB instruction allows efficient isolation of errors: 


¢ The ESB instruction does not wait for completion of accesses that cannot generate an asynchronous 
external abort. For example, if all external aborts are handled synchronously or it is known that no 
such accesses are outstanding. 

¢ The ESB instruction does not order accesses and does not guarantee a pipeline flush. 


All unrecoverable errors must be synchronized by an ESB instruction. The ESB instruction guarantees the 
following: 


« All unrecoverable errors that are generated before the ESB instruction have pended a System Error 
Interrupts (SEI) exception. 
¢ Ifa physical SEI is pended by or was pending before the ESB instruction is executed: 
— If the physical SEI is unmasked at the current Exception level, then it is taken before completion 
of the ESB instruction. 
— If the physical SEI is masked at the current Exception level, the pending SEI is cleared, the SEI 
syndrome is recorded in DISR/DISR_EL1, and DISR/DISR_EL1.A is set to 1. This indicates that 
the SEI was generated before the ESB by instructions that occur in program order. 


The ESB instruction also guarantees the following: 


« SElIs generated before the ESB instruction are either taken before or at the ESB instruction, or are 
pended in DISR/DISR_ELI1. 
¢ SEIs generated after the ESB are not pended in DISR/DISR_ELI. 


This includes unrecoverable errors that are generated by instructions, translation table walks, and 
instructions fetches on the same core. 


Note 


DISR/DISR_ELI can only be accessed at EL1 or above. If EL2 is implemented and HCR/ 
HCR_EL2.AMO is set to 1, then reads and writes of DISR/DISR_EL1 at Non-secure EL1 access 
VDISR/VDISR_EL2. 

¢ B2.39 DISR_EL1, Deferred Interrupt Status Register, EL] on page B2-358. 

¢ B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 on page B2-377. 

¢ B2.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 on page B2-455. 
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A8.6 Error reporting 


Detected errors are reported in the Error Record Primary Syndrome Register, ERXSTATUS/ 
ERXSTATUS_ELI, and the Error Record Miscellaneous Register, ERXMISCO/ERXMISCO_ELI. 


This includes errors that are successfully corrected, and errors that cannot be corrected. If multiple errors 
occur on the same clock cycle, then only one error is reported but the OF (overflow) bit is set. 


There are two error records provided, which can be selected with the ERRSELR/ERRSELR_EL1 
register. Record 0 is private to the core, and is updated on any error in the core RAMs including L1 
caches, TLB, and L2 cache. Record 1 records any error in the L3 and snoop filter RAMs and is shared 
between all cores in the cluster. 


If enabled in the ERXCTLR/ERXCTLR_ELI register, all errors that are detected cause a fault handling 
interrupt. The fault handling interrupt is generated on the nRFAULTIRQ[0] pin for L3 and snoop filter 
errors, or on the nRFAULTIRQJ[n+1] pin for core n L1 and L2 errors. 


Errors that cannot be corrected, and therefore might result in data corruption, also cause an abort or an 
interrupt signal to be asserted, alerting software to the error. The software can either attempt to recover or 
can restart the system. Some errors are deferred by poisoning the data. This does not cause an abort at the 
time of the error, but only when the error is consumed. 


¢ Uncorrectable errors in the L1, L2, or L3 data RAMs when read by an instruction fetch, a load 
instruction or a TLB pagewalk, might result in a precise data abort or prefetch abort. 

¢ Uncorrectable errors in the L1, L2, or L3 data RAMs when the line is being evicted from a cache 
causes the data to be poisoned. This might be because of a natural eviction, a linefill from a higher 
level of cache, a cache maintenance operation, or a snoop. If the poisoned line is evicted from the 
cluster for any reason, and the interconnect does not support data poisoning, then the nRERRIRQ[0] 
pin is asserted, if enabled. 

¢ Uncorrectable errors in the L1 tag or dirty RAMs, or in the L2 tag RAMs, causes the nRERRIRQ[n 
+1] pin to be asserted for core n, if enabled. 

¢ Uncorrectable errors in the L3 tag RAMs or SCU snoop filter RAMs causes the nRERRIRQJ0] pin to 
be asserted, if enabled. 





Note 
¢ When nERRIRQ 1s asserted it remains asserted until the error is cleared by a write of 0 to the UE bit 
in the ERXSTATUS/ERXSTATUS ELI register. 
« Arm recommends that the nRERRIRQ pin is connected to the interrupt controller so that an interrupt 
or system error is generated when the pin is asserted. 





The fault and error interrupt pins are cleared by writing to the ERXSTATUS/ERXSTATUS_EL1 
registers. 


When a snoop hits on a line with an uncorrectable data error, the data is returned if required by the 
snoop, but the snoop response indicates that the data is poisoned. If a snoop hits on a tag that has an 
uncorrectable error, then it is treated as a snoop miss, because the error means that it is unknown if the 
cache line is valid or not. 


The following accesses update the Error Record Primary Syndrome Register: 

¢ ECC error detected in any of the RAM protected by ECC. 

¢ Poisoned data received from the DSU when the CPU does not support ECC protection. 
¢ Dirty data received from the DSU and the data is flagged with a data error. 


Note 


It is possible for an error to be counted more than once. For example, multiple accesses can read the 
location with the error before the line is evicted. 
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Observations and constraints 
The following observations should be made about ERRXSTATUS and ERRXMISCn registers: 


If two or more memory errors occur in the same cycle, only one error is reported and the 
other error count is incremented. If more than two errors occur on the same cycle then the 
additional errors will not be counted. 

If two or more first memory error events from different RAMs occur in the same cycle, one 
of the errors is selected arbitrarily. 

If a new error arrives while the ERRXSTATUS.V bit is set, the way, index, and level 
information is not updated, but the other error field or the repeat error field is updated. 

If two or more memory errors from different RAMs that do not match the level, way and 
index information in this register when the ERRXSTATUS.V bit is set, occur in the same 
cycle, the Other error count field is only incremented once. 

This register is not reset on a warm reset. 


Related reference 
C2.4 PMU events on page C2-567 
B1.45 ERXSTATUS, Selected Error Record Primary Status Register on page B1-197 
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A8.7 Error injection 


To support testing of error handling software, the Cortex-A55 core can fake errors in the error detection 


logic. 


The following table 


describes the possible types of errors that the core can encounter and therefore fake. 


Table A8-2 Errors injected in the Cortex-A55 core 











snoop on the L1. 


Error type Description 
Corrected errors A CE is generated for a single ECC error on L1 data cache access. 
Deferred errors A DE is generated for a double ECC error on eviction of a cache line from the L1 to the L2, or as a result of a 





Uncontainable errors | A UC is generated for a double ECC error on the L1 TAG RAM following an eviction. 











Latent error A UEO is generated as a double ECC error on an L1 data read. 








The following table describes the registers that handle error injection in the Cortex-A55 core. 


Register name 


Table A8-3 Error injection registers 


Description 





ERR<n>PFGFR 


The ERR Pseudo Fault Generation Feature register defines which errors can be injected. 





ERR<n>PFGCTLR 


The ERR Pseudo Fault Generation Control register controls the errors that are injected. 








ERXPFGCDN _EL1 








The Selected Pseudo Fault Generation Count Down register controls the fault injection timing. 





Note 





This mechanism simulates the corruption of any RAM but the data is not corrupted. 
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Chapter AQ 
Generic Interrupt Controller CPU interface 


This chapter describes the Cortex-A55 core implementation of the Arm Generic Interrupt Controller 
(GIC) CPU interface. 


It contains the following sections: 


¢ A9.1 About the Generic Interrupt Controller CPU interface on page A9-110. 
¢ A9.2 Bypassing the CPU interface on page A9-111. 
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A9.1 About the Generic Interrupt Controller CPU interface 


The GIC CPU interface, when integrated with an external distributor component, is a resource for 
supporting and managing interrupts in a cluster system. 


The GIC CPU interface hosts registers to mask, identify, and control states of interrupts forwarded to that 
core. There is a separate GIC CPU interface for each core in the system. 


The Cortex-A55 core implements the GIC CPU interface as described in the Arm® Generic Interrupt 
Controller Architecture Specification. This interfaces with an external GICv3 or GICV4 interrupt 
distributor component within the system. 





Note 


This chapter describes only features that are specific to the Cortex-A55 core implementation. Additional 
information specific to the DSU can be found in Arm® DynamIQ™ Shared Unit Technical Reference 
Manual. 





The GICv4 architecture supports: 


¢ Two security states. 

¢ Interrupt virtualization. 

¢ Software-generated Interrupts (SGIs). 

¢ Message Based Interrupts. 

¢ System register access for the CPU interface. 

¢ Interrupt masking and prioritization. 

¢ Cluster environments, including systems that contain more than eight cores. 
« Wake-up events in power management environments. 


The GIC includes interrupt grouping functionality that supports: 

¢ Configuring each interrupt to belong to an interrupt group. 

¢ Signaling Group | interrupts to the target core using either the IRQ or the FIQ exception request. 
¢ Signaling Group 0 interrupts to the target core using the FIQ exception request only. 

¢ A unified scheme for handling the priority of Group 0 and Group | interrupts. 


This chapter describes only features that are specific to the Cortex-A55 core implementation. 
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AQ9.2 Bypassing the CPU interface 
The GIC CPU interface is always implemented within the Cortex-A55 core. 


However, you can disable it if you assert the GICCDISABLE signal HIGH at reset. If the GIC is 
enabled, the input pins nVIRQ and nVFIQ must be tied off to HIGH. This is because the internal GIC 
CPU interface generates the virtual interrupt signals to the cores. The nIRQ and nFIQ signals are 
controlled by software, therefore there is no requirement to tie them HIGH. If you disable the GIC CPU 
interface, the input pins nVIRQ and nVFIQ can be driven by an external GIC in the SoC. 


If the Cortex-A55 core is not integrated with an external GICv3 or GICv4 distributor component in the 
system, then you can disable the GIC CPU interface by asserting the GICCDISABLE signal HIGH at 
reset. 


GIC system register access generates UNDEFINED instruction exceptions when the GICCDISABLE signal 
is HIGH. 
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Part B 


Register Descriptions 


Chapter B1 
AArch32 system registers 


This chapter describes the system registers in the AArch32 state. 


It contains the following sections: 


B1.1 AArch32 registers on page B1-118. 

B1.2 AArch32 architectural system register summary on page B1-119. 

B1.3 AArch32 implementation defined register summary on page B1-125. 

B1.4 AArch32 registers by functional group on page B1-127. 

B1.5 ACTLR, Auxiliary Control Register on page B1-133. 

B1.6 ACTLR2, Auxiliary Control Register 2 on page B1-135. 

B1.7 ADFSR, Auxiliary Data Fault Status Register on page B1-136. 

B1.S AHTCR, Auxiliary Hypervisor Translation Control Register on page B1-137. 
B1.9 AIDR, Auxiliary ID Register on page B1-139. 

B1.10 AIFSR, Auxiliary Instruction Fault Status Register on page B1-140. 


B1.11 AMAIRO, Auxiliary Memory Attribute Indirection Register 0 on page B1-141. 
B1.12 AMAIRI, Auxiliary Memory Attribute Indirection Register I on page B1-142. 
B1.13 ATTBCR, Auxiliary Translation Table Base Control Register on page B1-143. 


B1.14 AVTCR, Auxiliary Virtualized Translation Control Register on page B1-145. 
B1.15 CCSIDR, Cache Size ID Register on page B1-147. 

B1.16 CLIDR, Cache Level ID Register on page B1-150. 

B1.17 CPACR, Architectural Feature Access Control Register on page B1-152. 
B1.18 CPUACTLR, CPU Auxiliary Control Register on page B1-153. 

B1.19 CPUCFR, CPU Configuration Register on page B1-155. 

B1.20 CPUECTLR, CPU Extended Control Register on page B1-157. 

B1.21 CPUPCR, CPU Private Control Register on page B1-161. 

B1.22 CPUPMR, CPU Private Mask Register on page B1-163. 

B1.23 CPUPOR, CPU Private Operation Register on page B1-165. 
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B1.24 CPUPSELR, CPU Private Selection Register on page B1-167. 
B1.25 CPUPWRCTLR, CPU Power Control Register on page B1-169. 
B1.26 CSSELR, Cache Size Selection Register on page B1-172. 

B1.27 CTR, Cache Type Register on page B1-173. 

B1.28 DFSR, Data Fault Status Register on page B1-175. 

B1.29 DISR, Deferred Interrupt Status Register on page B1-177. 
B1.30 ERRIDR, Error ID Register on page B1-181. 

B1.31 ERRSELR, Error Record Select Register on page B1-182. 


B1.32 ERXADDR, Selected Error Record Address Register on page B1-183. 

B1.33 ERXADDR2, Selected Error Record Address Register 2 on page B1-184. 
B1.34 ERXCTLR, Selected Error Record Control Register on page B1-185. 

B1.35 ERXCTLR2, Selected Error Record Control Register 2 on page B1-186. 
B1.36 ERXFR, Selected Error Record Feature Register on page B1-187. 

B1.37 ERXFR2, Selected Error Record Feature Register 2 on page B1-188. 

B1.38 ERXMISCO, Selected Error Miscellaneous Register 0 on page B1-189. 

B1.39 ERXMISCI1, Selected Error Miscellaneous Register I on page B1-190. 

B1.40 ERXMISC2, Selected Error Record Miscellaneous Register 2 on page B1-191. 
B1.41 ERXMISC3, Selected Error Record Miscellaneous Register 3 on page B1-192. 
B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation Count Down Register 


on page B1-193. 


B1 AArch32 system registers 


B1.43 ERXPFGCTLR, Selected Error Pseudo Fault Generation Control Register on page B1-195. 


B1.44 ERXPFGFR, Selected Pseudo Fault Generation Feature Register on page B1-196. 
B1.45 ERXSTATUS, Selected Error Record Primary Status Register on page B1-197. 


B1.46 FCSEIDR, FCSE Process ID Register on page B1-198. 

B1.47 HACR, Hyp Auxiliary Configuration Register on page B1-199. 
B148 HACTLR, Hyp Auxiliary Control Register on page B1-200. 
B1.49 HACTLR2, Hyp Auxiliary Control Register 2 on page B1-202. 


B1.50 HADFSR, Hyp Auxiliary Data Fault Status Syndrome Register on page B1-203. 
B1.51 HAIFSR, Hyp Auxiliary Instruction Fault Status Syndrome Register on page B1-204. 
B1.52 HAMAIRO, Hyp Auxiliary Memory Attribute Indirection Register 0 on page B1-205. 
B1.53 HAMAIRI, Hyp Auxiliary Memory Attribute Indirection Register 1 on page B1-206. 


B1.54 HCR, Hyp Configuration Register on page B1-207. 

B1.55 HCR2, Hyp Configuration Register 2 on page B1-209. 

B1.56 HSCTLR, Hyp System Control Register on page B1-210. 

B1.57 HSR, Hyp Syndrome Register on page B1-212. 

B1.58 HTTBR, Hyp Translation Table Base Register on page B1-214. 
B1.59 ID_AFRO, Auxiliary Feature Register 0 on page B1-215. 

B1.60 ID_DFRO, Debug Feature Register 0 on page B1-216. 

B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218. 
B1.62 ID_ISAR1, Instruction Set Attribute Register I on page B1-220. 
B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222. 
B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224. 
B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226. 
B1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228. 
B1.67 ID_ISAR6, Instruction Set Attribute Register 6 on page B1-230. 


B1.68 ID_MMFRO, Memory Model Feature Register 0 on page B1-231. 
B1.69 ID_MMFRI1, Memory Model Feature Register 1 on page B1-233. 
B1.70 ID_MMFR2, Memory Model Feature Register 2 on page B1-235. 
B1.71 ID_MMFR3, Memory Model Feature Register 3 on page B1-237. 
B1.72 ID_MMFR4, Memory Model Feature Register 4 on page B1-239. 


B1.73 ID_PFRO, Processor Feature Register 0 on page B1-241. 
B1.74 ID_PFRI1, Processor Feature Register 1 on page B1-243. 
B1.75 IFSR, Instruction Fault Status Register on page B1-245. 
B1.76 MIDR, Main ID Register on page B1-247. 

B1.77 MPIDR, Multiprocessor Affinity Register on page B1-248. 
B1.78 PAR, Physical Address Register on page B1-250. 
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B1.79 REVIDR, Revision ID Register on page B1-255. 

B1.80 SCR, Secure Configuration Register on page B1-256. 

B1.81 SCTLR, System Control Register on page B1-257. 

B1.82 SDCR, Secure Debug Control Register on page B1-260. 

B1.83 TTBCR, Translation Table Base Control Register on page B1-262. 
B1.84 TTBCR2, Translation Table Base Control Register 2 on page B1-266. 
B1.85 TTBRO, Translation Table Base Register 0 on page B1-269. 

B1.86 TTBRI, Translation Table Base Register 1 on page B1-271. 

B1.87 VDFSR, Virtual SError Exception Syndrome Register on page B1-273. 
B1.88 VDISR, Virtual Deferred Interrupt Status Register on page B1-274. 
B1.89 VMPIDR, Virtualization Multiprocessor ID Register on page B1-277. 
B1.90 VPIDR, Virtualization Processor ID Register on page B1-278. 

B1.91 VTCR, Virtualization Translation Control Register on page B1-279. 
B1.92 VTTBR, Virtualization Translation Table Base Register on page B1-281. 
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B1.1 AArch32 registers 


This chapter provides information about AArch32 system registers with implementation defined bit 
fields and implementation defined registers associated with the core. 


The chapter provides implementation specific information, for a complete description of the registers, see 
the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile.The chapter is 
presented as follows: 


AArch32 architectural system register summary 


This section identifies the AArch32 architecturally defined registers implemented in the Cortex- 
ASS core. 


The first table identifies the registers that have implementation defined bit fields. The register 
descriptions for these registers only contain information about the implementation defined bits. 


The second table identifies the other architecturally defined registers that are implemented in the 
Cortex-A55 core. These registers are described in the Arm® Architecture Reference Manual 
Armvé, for Armv8-A architecture profile. 


AArch32 implementation defined register summary 


This section identifies the AArch32 registers implemented in the Cortex-A55 core that are 
implementation defined. 


AArch32 registers by functional group 


This section groups the implementation defined registers and architectural system registers with 
implementation defined bit fields, as identified previously, by function. It also provides reset 
details for key register types. 


Register descriptions 


The remainder of the chapter provides register descriptions of the implementation defined 
registers and architectural system registers with implementation defined bit fields, as identified 
previously. These are listed in alphabetic order. 
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B1.2 AArch32 architectural system register summary 


This section identifies the AArch32 architectural system registers implemented in the Cortex-A55 core. 


The section contains two tables: 


Registers with implementation defined bit fields 


This table identifies the architecturally defined registers in the Cortex-A55 core that have 
IMPLEMENTATION DEFINED bit fields. The register descriptions for these registers only contain 
information about the implementation defined features. 


See Zable BI-1 Registers with implementation defined bit fields on page B1-119. 


Other architecturally defined registers 


This table identifies the other architecturally defined registers that are implemented in the 
Cortex-A55 core. These registers are described in the Arm® Architecture Reference Manual 
Armvé, for Armv8-A architecture profile. 


See Zable BI-2 Other architecturally defined registers on page B1-122. 


Registers with implementation defined bit fields 


For all the registers listed in the following table, coproc==@b1111. 


Table B1-1 Registers with implementation defined bit fields 






















































































Name CRn | Opc1|}CRm | Opce2__ | Width | Description 
ACTLR cl 0 c0 1 32 B1.5 ACTLR, Auxiliary Control Register on page B1-133 
ACTLR2 cl 0 c0 3 32 B1.6 ACTLR2, Auxiliary Control Register 2 on page B1-135 
AIDR c0 1 c0 7 32 B1.9 AIDR, Auxiliary ID Register on page B1-139 
ADFSR c5 0 cl 0 32 B1.7 ADFSR, Auxiliary Data Fault Status Register on page B1-136 
AIFSR c5 0 cl 1 32 B1.10 AIFSR, Auxiliary Instruction Fault Status Register 
on page B1-140 
AMAIRO clO |0 c3 0 32 B1.11 AMAIRO, Auxiliary Memory Attribute Indirection Register 0 
on page B1-141 
AMAIR1 cl0 |0 c3 1 32 B1.12 AMAIRI, Auxiliary Memory Attribute Indirection Register 1 
on page B1-142 
CCSIDR c0 1 c0 0 32 B1.15 CCSIDR, Cache Size ID Register on page B1-147 
CLIDR c0 1 c0 1 32 B1.16 CLIDR, Cache Level ID Register on page B1-150 
CPACR cl 0 c0 2 32 B1.17 CPACR, Architectural Feature Access Control Register 
on page B1-152 
CSSELR c0 2 c0 0 32 B1.26 CSSELR, Cache Size Selection Register on page B1-172 
CTR c0 0 c0 1 32 B1.27 CTR, Cache Type Register on page B1-173 
DFSR c5 0 c0 0 32 B1.28 DFSR, Data Fault Status Register on page B1-175 
DISR cl2 |0 cl 1 32 B1.29 DISR, Deferred Interrupt Status Register on page B1-177 
ERRIDR c5 0 c3 0 32 B1.30 ERRIDR, Error ID Register on page B1-181 
ERRSELR c5 0 c3 1 32 B1.31 ERRSELR, Error Record Select Register on page B1-182 
ERXADDR c5 0 c4 3 32 B1.32 ERXADDR, Selected Error Record Address Register 
on page B1-183 
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Table B1-1 Registers with implementation defined bit fields (continued) 



















































































Name CRn | Opc1|CRm|Opc2 | Width | Description 

ERXADDR2 c5 0 c4 7 32 B1.33 ERXADDR2, Selected Error Record Address Register 2 
on page B1-184 

ERXCTLR c5 0 c4 1 32 B1.34 ERXCTLR, Selected Error Record Control Register 
on page B1-185 

ERXCTLR2 c5 0 c4 2 32 B1.35 ERXCTLR2, Selected Error Record Control Register 2 
on page B1-186 

ERXFR c5 0 c4 0 32 B1.36 ERXFR, Selected Error Record Feature Register 
on page B1-187 

ERXFR2 c5 0 c4 4 32 B1.37 ERXFR2, Selected Error Record Feature Register 2 
on page B1-188 

ERXMISCO c5 0 c5 0 32 B1.38 ERXMISCO, Selected Error Miscellaneous Register 0 
on page B1-189 

ERXMISC1 c5 0 c5 1 32 B1.39 ERXMISC1, Selected Error Miscellaneous Register 1 
on page B1-190 

ERXMISC2 c5 0 c5 4 32 B1.40 ERXMISC2, Selected Error Record Miscellaneous Register 2 
on page B1-191 

ERXMISC3 c5 0 cs 5 32 B1.41 ERXMISC3, Selected Error Record Miscellaneous Register 3 
on page B1-192 

ERXSTATUS c5 0 c4 2 32 B1.45 ERXSTATUS, Selected Error Record Primary Status Register 
on page B1-197 

FCSEIDR cl3 |0 c0 0 32 B1.46 FCSEIDR, FCSE Process ID Register on page B1-198 

FPSID es a c3 1 32 Floating-Point System ID Register. For more information, see the 
Arm® Cortex®-A55 Core Advanced SIMD and Floating-point Support 
Technical Reference Manual. 

HACR cl 4 cl 7 32 B1.47 HACR, Hyp Auxiliary Configuration Register on page B1-199 

HACTLR cl 4 c0 1 32 B1.48 HACTLR, Hyp Auxiliary Control Register on page B1-200 

HACTLR2 cl 4 c0 3 32 B1.49 HACTLR2, Hyp Auxiliary Control Register 2 on page B1-202 

HADFSR c5 4 cl 0 32 B1.50 HADFSR, Hyp Auxiliary Data Fault Status Syndrome Register 
on page B1-203 

HAIFSR c5 4 cl 1 32 B1.51 HAIFSR, Hyp Auxiliary Instruction Fault Status Syndrome 
Register on page B1-204 

HAMAIRO clO |4 c3 0 32 B1.52 HAMAIRO, Hyp Auxiliary Memory Attribute Indirection 
Register 0 on page B1-205 

HAMAIRI1 clO |4 c3 1 32 B1.53 HAMAIR1, Hyp Auxiliary Memory Attribute Indirection 
Register I on page B1-206 

HCR cl 4 cl 0 32 B1.54 HCR, Hyp Configuration Register on page B1-207 

HCR2 cl + cl + 32 B1.55 HCR2, Hyp Configuration Register 2 on page B1-209 

HSR c5 4 c2 0 32 B1.57 HSR, Hyp Syndrome Register on page B1-212 

ID_AFRO c0 0 cl 3 32 B1.59 ID_AFRO, Auxiliary Feature Register 0 on page B1-215 

ID_DFRO c0 0 cl 2 32 B1.60 ID_DFRO, Debug Feature Register 0 on page B1-216 
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Table B1-1 Registers with implementation defined bit fields (continued) 




















































































































Name CRn | Opc1|CRm|Opc2 __ | Width | Description 
ID_ISARO c0 0 c2 0 32 B1.61 ID_ISARO, Instruction Set Attribute Register 0 
on page B1-218 
ID_ISAR1 c0 0 c2 1 32 B1.62 ID_ISAR1, Instruction Set Attribute Register 1 
on page B1-220 
ID_ISAR2 c0 0 c2 2 32 B1.63 ID_ISAR2, Instruction Set Attribute Register 2 
on page B1-222 
ID_ISAR3 c0 0 c2 3 32 B1.64 ID_ISAR3, Instruction Set Attribute Register 3 
on page B1-224 
ID_ISAR4 c0 0 c2 4 32 B1.65 ID_ISAR4, Instruction Set Attribute Register 4 
on page B1-226 
ID_ISAR5 c0 0 c2 3 32 B1.66 ID_ISARS, Instruction Set Attribute Register 5 
on page B1-228 
ID_ISAR6 c0 0 c2 7 32 B1.67 ID_ISAR6, Instruction Set Attribute Register 6 
on page B1-230 
ID_MMFRO c0 0 cl 4 32 B1.68 ID_MMFRO, Memory Model Feature Register 0 
on page B1-231 
ID_MMEFRI1 c0 0 cl 5 32 B1.69 ID_MMFRI1, Memory Model Feature Register 1 
on page B1-233 
ID_MMFR2 c0 0 cl 6 32 B1.70 ID_MMFR2, Memory Model Feature Register 2 
on page B1-235 
ID_MMFR3 c0 0 cl 7 32 B1.71 ID_MMFR3, Memory Model Feature Register 3 
on page B1-237 
ID_MMFR4 c0 0 c2 6 32 B1.72 ID_MMFR4, Memory Model Feature Register 4 
on page B1-239 
ID_PFRO c0 0 cl 0 32 B1.73 ID_PFRO, Processor Feature Register 0 on page B1-241 
ID_PFRI c0 0 cl 1 32 B1.74 ID_PFRI, Processor Feature Register 1 on page B1-243 
IFSR c5 0 c0 1 32 B1.75 IFSR, Instruction Fault Status Register on page B1-245 
MIDR c0 0 c0 0, 4, or 7 | 32 B1.76 MIDR, Main ID Register on page B1-247 
MPIDR c0 0 c0 5 32 B1.77 MPIDR, Multiprocessor Affinity Register on page B1-248 
PAR (32 bits access) | c7 0 c4 0 32 B1.78 PAR, Physical Address Register on page B1-250 
PAR (64 bits access) | - 0 c7 - 64 B1.78 PAR, Physical Address Register on page B1-250 
REVIDR c0 0 c0 6 32 B1.79 REVIDR, Revision ID Register on page B1-255 
SCR cl 0 cl 0 32 B1.80 SCR, Secure Configuration Register on page B1-256 
SCTLR cl 0 c0 0 32 B1.81 SCTLR, System Control Register on page B1-257 
SDCR cl 0 c3 1 32 B1.82 SDCR, Secure Debug Control Register on page B1-260 
TTBCR c2 0 c0 2 32 B1.83 TTBCR, Translation Table Base Control Register 
on page B1-262 
TTBRO (32 bits c2 0 c0 0 32 B1.85 TTBRO, Translation Table Base Register 0 on page B1-269 
access) 
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Table B1-1 Registers with implementation defined bit fields (continued) 



































Name CRn | Opc1 | CRm | Opc2 Width | Description 
TTBRO (64 bits - 0 c2 - 64 B1.85 TTBRO, Translation Table Base Register 0 on page B1-269 
access) 
TTBR1 (32 bits c2 0 c0 1 32 B1.86 TTBR1, Translation Table Base Register 1 on page B1-271 
access) 
TTBR1 (64 bits - 1 c2 - 64 B1.86 TTBR1, Translation Table Base Register 1 on page B1-271 
access) 
VDFSR c5 4 c2 3 32 B1.87 VDFSR, Virtual SError Exception Syndrome Register 

on page B1-273 
VDISR cl2 |4 cl 1 32 B1.88 VDISR, Virtual Deferred Interrupt Status Register 

on page B1-274 
VMPIDR c0 4 c0 3 32 B1.89 VMPIDR, Virtualization Multiprocessor ID Register 

on page B1-277 
VPIDR c0 4 c0 0 32 B1.90 VPIDR, Virtualization Processor ID Register on page B1-278 
VTCR c2 4 cl 2 32 B1.91 VTCR, Virtualization Translation Control Register 

on page B1-279 
VTTBR - 6 c2 - 64 B1.92 VTTBR, Virtualization Translation Table Base Register 

on page B1-281 


























Other architecturally defined registers 
For the registers listed in the following table, coproc==0b1111, except for: 


¢ Jazelle ID Register. 
¢ Jazelle Main Configuration Register. 


¢ Jazelle OS Control Register. 


For these registers, coproc==@b1110. 


Table B1-2 Other architecturally defined registers 




































































Name CRn | Opc1 | CRm | Opc2 | Width | description 

CPACR cl 0 c0 2 32 Architectural Feature Access Control Register 
CNTFRQ cl4 |0 c0 0 32 Timer Clock Ticks per Second 

CNTHCTL cl4 |4 cl 0 32 Timer Hyp Control register 

CNTHP CTL |cl4 |4 c2 1 32 Counter-timer Hyp Physical Timer Control register 
CNTHP_CVAL | - 6 cl4_ |- 64 Counter-timer Hyp Physical CompareValue register 
CNTHP_TVAL |cl4 |4 c2 0 32 Counter-timer Hyp Physical Timer TimerValue register 
CNTKCTL cl4 |0 cl 0 32 Counter-timer Kernel Control register 

CNTP_CTL cl4 |0 c2 1 32 Counter-timer Physical Timer Control register 
CNTP_CVAL  |- 2 cl4_ |- 64 Counter-timer Physical Timer CompareValue register 
CNTP_TVAL |cl4 |0 c2 0 32 Counter-timer Physical Timer TimerValue register 
CNTPCT - 0 cl4_ |- 64 Counter-timer Physical Count register 

CNTV_CTL cl4 |0 c3 1 32 Counter-timer Virtual Timer Control register 
CNTV_CVAL |- 3 cl4_ |- 64 Counter-timer Virtual Timer Compare Value register 
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Table B1-2 Other architecturally defined registers (continued) 























































































































Name CRn | Opc1 | CRm | Opc2 | Width | description 

CNTV_TVAL |cl4 |0 c3 0 32 Counter-timer Virtual Timer TimerValue register 
CNTVCT - 1 cl4 |- 64 Counter-timer Virtual Count register 
CNTVOFF - 4 cl4_ |- 64 Counter-timer Virtual Offset register 
CONTEXTIDR |cl3_ | 0 c0 1 32 Context ID Register 

DACR c3 0 c0 0 32 Domain Access Control Register 

DFAR c6 0 c0 0 32 Data Fault Address Register 

DLR c4 3 c5 1 32 Debug Link Register 

DSPSR c4 3 c5 0 32 Debug Saved Program Status Register 
FPEXC c5 4 c3 0 32 Floating-point Exception Control register 
HCPTR cl 4 cl 2 32 Hypervisor Coprocessor Trap Register 
HDCR cl 4 cl 1 32 Hypervisor Debug Control Register 
HDFAR c6 4 c0 0 32 Hypervisor Data Fault Address 

HIFAR c6 4 c0 2 32 Hypervisor Instruction Fault Address 
HMAIRO cl0 c2 0 32 Hypervisor Memory Attribute Indirection Register 0 
HMAIR1 clO |4 c2 1 32 Hypervisor Memory Attribute Indirection Register 1 
HPFAR c6 4 c0 4 32 Hypervisor IPA Fault Address 

HTCR c2 4 c0 2 32 Hypervisor Translation Control Register 
HTPIDR cl3 |4 c0 2 32 Hypervisor Software Thread ID Register 
HTTBR - 4 c2 - 64 Hypervisor Translation Table Base Register 
HVBAR cl2 |4 c0 0 32 Hypervisor Vector Base Address 

IFAR c6 c0 2 32 Instruction Fault Address Register 

ISR cl2 |0 cl 0 32 Interrupt Status Register 

JIDR c0 7 c0 0 32 Jazelle ID Register 

JMCR c2 oj c0 0 32 Jazelle Main Configuration Register 
JOSCR cl c0 0 32 Jazelle OS Control Register 

MAIRO cl0 |0 c2 1 32 Memory Attribute Indirection Register 0 
MAIR1 cl0 |0 c2 1 32 Memory Attribute Indirection Register 1 
MVBAR cl2 c0 1 32 Monitor Vector Base Address Register 
MVFRO c0 2 c3 0 32 Media and VFP Feature Register 0 

MVFRI c0 2 c3 1 32 Media and VFP Feature Register 1 

MVFR2 c0 2 c3 2 32 Media and VFP Feature Register 2 

NMRR cl0 |0 c2 1 32 Normal Memory Remap Register 

PRRR cl0 |0 c2 0 32 Primary Region Remap Register 

RMR cl2 |0 c0 2 32 Reset Management Register 

SDER cl 0 cl 1 32 Secure Debug Enable Register 
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Table B1-2 Other architecturally defined registers (continued) 


























Name CRn | Opc1 | CRm | Opc2 | Width | description 

TCMTR c0 0 c0 2 32 TCM Type Register 

TLBTR c0 0 c0 3 32 TLB Type Register 

TPIDRPRW cl3 10 c0 4 32 Privileged Only Thread ID Register 

TPIDRURO cl3 |0 c0 3 32 User Read Only Thread ID Register 

TPIDRURW cl3 |0 c0 2 32 User Read/Write Thread ID Register 
VBAR cl2 |0 c0 0 32, Vector Base Address Register 
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B1.3 AArch32 implementation defined register summary 
This section identifies the AArch32 registers implemented in the Cortex-A55 core that are 
implementation defined. The list of registers is sorted by opcode. 
The registers that are implemented but are architecturally defined are described in the Arm® Architecture 
Reference Manual Armvé, for Armv8-A architecture profile. 
Table B1-3 Cortex-A55 AArch32 implementation defined registers 
Name Copro | CRn | Opc1 | CRm | Opc2 | Width | Description 
AHTCR cp15 clS |4 c7 0 32 B1.8 AHTCR, Auxiliary Hypervisor Translation Control Register 
on page B1-137 
ATTBCR cp15 clS |0 c7 1 32 B1.13 ATTBCR, Auxiliary Translation Table Base Control 
Register on page B1-143 
AVTCR cp15 clS |4 c7 1 32 B1.14 AVTCR, Auxiliary Virtualized Translation Control Register 
on page B1-145 
CPUACTLR cp15 - 0 clS |- 64 B1.18 CPUACTLR, CPU Auxiliary Control Register 
on page B1-153 
CPUCFR cp15 clS |0 c0 0 32 B1.19 CPUCFR, CPU Configuration Register on page B1-155 
CPUECTLR cpl5_ |- 4 cl5 |- 64 B1.20 CPUECTLR, CPU Extended Control Register 
on page B1-157 
CPUPCR cp15 clS |6 c8 1 64 B1.21 CPUPCR, CPU Private Control Register on page B1-161 
CPUPMR cp15 clS |6 c8 3 64 B1.22 CPUPMR, CPU Private Mask Register on page B1-163 
CPUPOR cp15 cl5 |6 c8 2 64 B1.23 CPUPOR, CPU Private Operation Register 
on page B1-165 
CPUPSELR cp15 clS |6 c8 0 32 B1.24 CPUPSELR, CPU Private Selection Register 
on page B1-167 
CPUPWRCTLR |cpl5 |cl5 |0 c2 7 32 B1.25 CPUPWRCTLR, CPU Power Control Register 
on page B1-169 
ERROPFGFR* N/A N/A |N/A |N/A |N/A_ {32 B3.9 ERROPFGER, Error Pseudo Fault Generation Feature 
Register on page B3-479 
ERROPFGCTLR® | N/A N/A |N/A |N/A |N/A | 32 B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control 
Register on page B3-477 
ERROPFGCDNR‘ | N/A N/A |N/A |N/A |N/A | 32 B3.7 ERROPFGCDNR, Error Pseudo Fault Generation Count 
Down Register on page B3-476 
ERXPFGCDNR_ | cp15 cl5 |0 c2 2 32 B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation 
Count Down Register on page B1-193 
ERXPFGCTLR cp15 cl5 |0 c2 1 32 B1.43 ERXPFGCTLR, Selected Error Pseudo Fault Generation 
Control Register on page B1-195 
ERXPFGFR cp15 clS |0 c2 0 32 B1.44 ERXPFGFR, Selected Pseudo Fault Generation Feature 
Register on page B1-196 
































The following table shows the 32-bit wide implementation defined Cluster registers. Details of these 
registers can be found in Arm® DynamIQ™ Shared Unit Technical Reference Manual 





C — There is no direct access to ERRO* registers using MCR and MRC. 
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Table B1-4 Cluster registers 

























































































Name Copro | CRn | Opc1 | CRm | Opc2 | Width Description 
CLUSTERCFR cpl5 |cl5 |0 c3 0 32-bit Cluster configuration register. 
CLUSTERIDR cpl5 |cl5 |0 c3 1 32-bit Cluster main revision ID. 
CLUSTEREVIDR cpl5 |cl5 |0 c3 2 32-bit Cluster ECO ID. 
CLUSTERACTLR cpl5 |cl5 |0 c3 3 32-bit Cluster auxiliary control register. 
CLUSTERECTLR cpl5 |cl5 |0 c3 4 32-bit Cluster extended control register. 
CLUSTERPWRCTLR cpl5 |cl5 |0 c3 5 32-bit Cluster power control register. 
CLUSTERPWRDN cp15 cl5 |0 c3 6 32-bit Cluster power down register. 
CLUSTERPWRSTAT cp15 cl5 |0 c3 4 32-bit Cluster power status register. 
CLUSTERTHREADSID cpl5 |cl5 |0 c4 0 32-bit Cluster thread scheme ID register. 
CLUSTERACPSID cpl5 |cl5 |0 c4 1 32-bit Cluster ACP scheme ID register. 
CLUSTERSTASHSID cpl5 |cl5 |0 c4 2 32-bit Cluster stash scheme ID register. 
CLUSTERPARTCR cpl5 |cl5 |0 c4 3 32-bit Cluster partition control register. 
CLUSTERBUSQOS cpl5 |cl5 |0 c4 4 32-bit Cluster bus QoS control register. 
CLUSTERL3HIT cpl5 |cl5 |0 c4 5 32-bit Cluster L3 hit counter register. 
CLUSTERL3MISS cpl5 |cl5 |0 c4 6 32-bit Cluster L3 miss counter register. 
CLUSTERTHREADSIDOVR | cp15 |cl5 |0 c4 7 32-bit Cluster thread scheme ID override register. 
CLUSTERPM* cpl5 |cl5 |0or6 | c5-c6 | 0-7 32-bit or 64-bit | Cluster PMU registers. 
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B1.4 AArch32 registers by functional group 
This section identifies the AArch32 registers by their functional groups and applies to the registers in the 
core that are implementation defined or have micro-architectural bit fields. 
Reset values are provided for these registers. 
Identification registers 
Name Type | Reset Description 
AIDR RO | @xeee80000 B1.9 AIDR, Auxiliary ID Register on page B1-139 
CCSIDR =|RO |- B1.15 CCSIDR, Cache Size ID Register on page B1-147 
CLIDR RO | UNK B1.16 CLIDR, Cache Level ID Register on page B1-150 
Unknown: [31:30], If the L2 cache is not implemented, the value is: 
[25:24], [22:21], 8, 5 gunexaobas 
‘bl: [1:0] 
'bO: [29:26], 23, [20:9], 
[7:6], [4:2] 
CSSELR =| RW_| @xeeeee09es, [2:0] B1.26 CSSELR, Cache Size Selection Register on page B1-172 
UNK. 
CTR RO | @x84448004 B1.27 CTR, Cache Type Register on page B1-173 
ID_AFRO RO | exeeeeeeee B1.59 ID_AFRO, Auxiliary Feature Register 0 on page B1-215 
ID_DFRO |RO_ | 0x63010066 B1.60 ID_DFRO, Debug Feature Register 0 on page B1-216 
Bits [19:16] are @x1 if ETM is implemented, and @x@ otherwise. 
ID_ISARO |RO | Qx@2101110 B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218 
ID_ISARI |RO- | @x13112111 B1.62 ID_ISARI, Instruction Set Attribute Register 1 on page B1-220 
ID_ISAR2 |RO_ | Q@x21232042 B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222 
ID_ISAR3 |RO_ | @x@1112131 B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224 
ID_ISAR4 |RO | Qx@@011142 B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226 
ID_ISARS5 |RO | @x@@@11121 B1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228 
ID_ISARS has the value 0x00010001 if the Cryptographic Extension is not 
implemented and enabled. 
ID ISAR6 |RO | exeee0e90e1e B1.67 ID_ISAR6, Instruction Set Attribute Register 6 on page B1-230 
ID_MMFRO|RO_ | 9@x19201105 B1.68 ID_MMFRO, Memory Model Feature Register 0 on page B1-231 
ID_MMFR1|RO | @x4QQe0000 B1.69 ID_MMFRI1, Memory Model Feature Register 1 on page B1-233 
ID_MMFR2|RO_ | 9@x@1260000 B1.70 ID_MMFR2, Memory Model Feature Register 2 on page B1-235 
ID_MMFR3 | RO | 9@x@2102211 B1.71 ID_MMFR3, Memory Model Feature Register 3 on page B1-237 
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(continued) 








































































































Name Type | Reset Description 
ID_MMFR4|RO_ | 9@x@@021110 B1.72 ID_MMFR4, Memory Model Feature Register 4 on page B1-239 
ID_PFRO RO | @xeeeee131 B1.73 ID_PFRO, Processor Feature Register 0 on page B1-241 
ID_PFRI RO | @x10011011 B1.74 ID_PFR1, Processor Feature Register I on page B1-243 
Bits [31:28] are @x1 if the GIC CPU interface is implemented and enabled, and @x® 
otherwise. 
MIDR RO | 0x412FD@50 B1.76 MIDR, Main ID Register on page B1-247 
MPIDR RO |- B1.77 MPIDR, Multiprocessor Affinity Register on page B1-248 
REVIDR RO | exeeeeee0e B1.79 REVIDR, Revision ID Register on page B1-255 
VMPIDR | RW_|- B1.89 VMPIDR, Virtualization Multiprocessor ID Register on page B1-277 
The reset value is the value of MPIDR. 
VPIDR RW | 0x412FD@50 B1.90 VPIDR, Virtualization Processor ID Register on page B1-278 
Other system control registers 
Name Type | Description 
ACTLR RW | B1.5 ACTLR, Auxiliary Control Register on page B1-133 
ACTLR2 |RW | 87.6 ACTLR2, Auxiliary Control Register 2 on page B1-135 
HACTLR |RW_ | 81.48 HACTLR, Hyp Auxiliary Control Register on page B1-200 
HACTLR2|RW_ | 81.49 HACTLR2, Hyp Auxiliary Control Register 2 on page B1-202 
HSCTLR |RW | 87.56 HSCTLR, Hyp System Control Register on page B1-210 
SCTLR RW | B1.81 SCTLR, System Control Register on page B1-257 
RAS registers 
Name Type | Description 
DISR RW | B1.29 DISR, Deferred Interrupt Status Register on page B1-177 
ERRIDR RO | B1.30 ERRIDR, Error ID Register on page B1-181 
ERRSELR RW | B1.31 ERRSELR, Error Record Select Register on page B1-182 
ERXADDR RW_ | B1.32 ERXADDR, Selected Error Record Address Register on page B1-183 
ERXADDR2 RW_ | B1.33 ERXADDR2, Selected Error Record Address Register 2 on page B1-184 
ERXCTLR RW | B1.34 ERXCTLR, Selected Error Record Control Register on page B1-185 
ERXCTLR2 RW_ | B1.35 ERXCTLR2, Selected Error Record Control Register 2 on page B1-186 
ERXFR RO | B1.36 ERXFR, Selected Error Record Feature Register on page B1-187 
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(continued) 















































Name Type | Description 

ERXFR2 RO | B1.37 ERXFR2, Selected Error Record Feature Register 2 on page B1-188 

ERXMISCO RW_ | B1.38 ERXMISCO, Selected Error Miscellaneous Register 0 on page B1-189 

ERXMISC1 RW_ | B1.39 ERXMISCI, Selected Error Miscellaneous Register 1 on page B1-190 

ERXMISC2 RW_ | B1.40 ERXMISC2, Selected Error Record Miscellaneous Register 2 on page B1-191 

ERXMISC3 RW_ | B1.41 ERXMISC3, Selected Error Record Miscellaneous Register 3 on page B1-192 
ERXPFGCDNR | RW_ | B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation Count Down Register on page B1-193 
ERXPFGCTLR |RW_ | B1.43 ERXPFGCTLR, Selected Error Pseudo Fault Generation Control Register on page B1-195 
ERXPFGFR RO | B1.44 ERXPFGFR, Selected Pseudo Fault Generation Feature Register on page B1-196 
ERXSTATUS |RW_ | 8B1.45 ERXSTATUS, Selected Error Record Primary Status Register on page B1-197 

HCR2 RW | B1.55 HCR2, Hyp Configuration Register 2 on page B1-209 

VDFSR RW | B1.87 VDFSR, Virtual SError Exception Syndrome Register on page B1-273 

VDISR RW | B1.88 VDISR, Virtual Deferred Interrupt Status Register on page B1-274 











Virtual Memory control registers 





Name 


Type | Description 





AMAIRO | RW_ | B/.17 AMAIRO, Auxiliary Memory Attribute Indirection Register 0 on page B1-141 





AMAIRI | RW | 87.12 AMAIRI, Auxiliary Memory Attribute Indirection Register 1 on page B1-142 





AHTCR RW | B1.8 AHTCR, Auxiliary Hypervisor Translation Control Register on page B1-137 





ATTBCR |RW | 37.13 ATTBCR, Auxiliary Translation Table Base Control Register on page B1-143 





AVTCR RW | B1.14 AVICR, Auxiliary Virtualized Translation Control Register on page B1-145 





HAMAIRO|RW_ | 87.52 HAMAIRO, Hyp Auxiliary Memory Attribute Indirection Register 0 on page B1-205 





HAMAIRI |RW | 87.53 HAMAIRI1, Hyp Auxiliary Memory Attribute Indirection Register 1 on page B1-206 





HTTBR RW | B1.58 HTTBR, Hyp Translation Table Base Register on page B1-214 





SCTLR RW | B1.81 SCTLR, S: ystem Control Register on page B1-257 





TTBCR RW | B1.83 TTBCR, Translation Table Base Control Register on page B1-262 





TTBRO RW | B1.85 TTBRO, Translation Table Base Register 0 on page B1-269 





TTBRI RW | B1.86 TTBRI, Translation Table Base Register I on page B1-271 





VTCR 


RW | B1.91 VTCR, Virtualization Translation Control Register on page B1-279 








VTTBR RW | B1.92 VTTBR, Virtualization Translation Table Base Register on page B1-281 
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Virtualization registers 




















































































































Name Type | Description 
HACR RW | B1.47 HACR, Hyp Auxiliary Configuration Register on page B1-199 
HACTLR |RW_ | B/.48 HACTLR, Hyp Auxiliary Control Register on page B1-200 
HACTLR2 |RW | 87.49 HACTLR2, Hyp Auxiliary Control Register 2 on page B1-202 
HADFSR |RW | 87.50 HADFSR, Hyp Auxiliary Data Fault Status Syndrome Register on page B1-203 
HAISFR) |RW | B/.51 HAIFSR, Hyp Auxiliary Instruction Fault Status Syndrome Register on page B1-204 
HAMAIRO|RW | 27.52 HAMAIRO, Hyp Auxiliary Memory Attribute Indirection Register 0 on page B1-205 
HAMAIRI | RW | 27.53 HAMAIRI, Hyp Auxiliary Memory Attribute Indirection Register 1 on page B1-206 
HCR RW | B1.54 HCR, Hyp Configuration Register on page B1-207 
HCR2 RW | B1.55 HCR2, Hyp Configuration Register 2 on page B1-209 
HSR RW | B1.57 HSR, Hyp Syndrome Register on page B1-212 
HTTBR RW | B1.58 HTTBR, Hyp Translation Table Base Register on page B1-214 
VDFSR RW | B1.87 VDFSR, Virtual SError Exception Syndrome Register on page B1-273 
VDISR RW | B1.88 VDISR, Virtual Deferred Interrupt Status Register on page B1-274 
VMPIDR | RW | 87.89 VMPIDR, Virtualization Multiprocessor ID Register on page B1-277 
VPIDR RW | B1.90 VPIDR, Virtualization Processor ID Register on page B1-278 
VTCR RW | B1.91 VICR, Virtualization Translation Control Register on page B1-279 
VTTBR RW | B1.92 VTTBR, Virtualization Translation Table Base Register on page B1-281 
Exception and fault handling registers 
Name Type | Description 
ADFSR | RW | B/.7 ADFSR, Auxiliary Data Fault Status Register on page B1-136 
AIFSR RW | B1.10 AIFSR, Auxiliary Instruction Fault Status Register on page B1-140 
DFSR- | RW | 87.28 DFSR, Data Fault Status Register on page B1-175 
DISR RW | 81.29 DISR, Deferred Interrupt Status Register on page B1-177 
HADFSR | RW _ | 87.50 HADFSR, Hyp Auxiliary Data Fault Status Syndrome Register on page B1-203 
HAIFSR |RW | 87.57 HAIFSR, Hyp Auxiliary Instruction Fault Status Syndrome Register on page B1-204 
HSR RW | B1.57 HSR, Hyp Syndrome Register on page B1-212 
IFSR RW | B1.75 IFSR, Instruction Fault Status Register on page B1-245 
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(continued) 














Name Type | Description 
VDFSR_ |RW_ | 87.87 VDFSR, Virtual SError Exception Syndrome Register on page B1-273 
VDISR |RW_ | 87.88 VDISR, Virtual Deferred Interrupt Status Register on page B1-274 



























































Name Type | Reset Description 

AHTCR RW |- B1.8 AHTCR, Auxiliary Hypervisor Translation Control Register on page B1-137 

ATTBCR RW |- B1.13 ATTBCR, Auxiliary Translation Table Base Control Register 
on page B1-143 

AVTCR RW |- B1.14 AVTCR, Auxiliary Virtualized Translation Control Register on page B1-145 

CPUACTLR =| RW |. B1.18 CPUACTLR, CPU Auxiliary Control Register on page B1-153 

CPUCFR RO |- B1.19 CPUCFR, CPU Configuration Register on page B1-155 

ERXPFGCDNR | RW_}- B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation Count Down 
Register on page B1-193 

ERXPFGCTLR |RW_ |- B1.43 ERXPFGCTLR, Selected Error Pseudo Fault Generation Control Register 
on page B1-195 

ERXPFGFR RO - B1.44 ERXPFGFR, Selected Pseudo Fault Generation Feature Register 
on page B1-196 

CPUECTLR RW | @xe90000002808BC80 | B/.20 CPUECTLR, CPU Extended Control Register on page B1-157 

CPUPCR RY lle B1.21 CPUPCR, CPU Private Control Register on page B1-161 

CPUPMR RW |- B1.22 CPUPMR, CPU Private Mask Register on page B1-163 

CPUPOR RW |- B1.23 CPUPOR, CPU Private Operation Register on page B1-165 

CPUPSELR RW |- 








B1.24 CPUPSELR, CPU Private Selection Register on page B1-167 











The following table shows the 32-bit wide implementation defined Cluster registers. These registers are 
RW, and details can be found in Arm® DynamIQ™ Shared Unit Technical Reference Manual 





Table B1-5 Cluster registers 





























Name Copro | CRn | Opc1 | CRm | Opc2 | Width Description 

CLUSTERCFR cpl5 |cl5 |0 c3 0 32-bit Cluster configuration register. 
CLUSTERIDR cpl5 |cl5 |0 c3 1 32-bit Cluster main revision ID. 
CLUSTEREVIDR cpl5 |cl5 |0 c3 2 32-bit Cluster ECO ID. 
CLUSTERACTLR cpl5 |cl5 |0 c3 3 32-bit Cluster auxiliary control register. 
CLUSTERECTLR cpl5 |cl5 |0 c3 4 32-bit Cluster extended control register. 
CLUSTERPWRCTLR cpl5 |cl5 |0 c3 5 32-bit Cluster power control register. 
CLUSTERPWRDN cpl5 |cl5 |0 c3 6 32-bit Cluster power down register. 
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Table B1-5 Cluster registers (continued) 

































































Name Copro | CRn | Opc1 | CRm | Opc2 | Width Description 
CLUSTERPWRSTAT cpl5 |cl5 |0 c3 7 32-bit Cluster power status register. 
CLUSTERTHREADSID cpl5 |cl5 |0 c4 0 32-bit Cluster thread scheme ID register. 
CLUSTERACPSID cpl5 |cl5 |0 c4 1 32-bit Cluster ACP scheme ID register. 
CLUSTERSTASHSID cplS |cl5 |0 c4 2 32-bit Cluster stash scheme ID register. 
CLUSTERPARTCR cpl5 |cl5 |0 c4 3 32-bit Cluster partition control register. 
CLUSTERBUSQOS cp15 cl5 |0 c4 4 32-bit Cluster bus QoS control register. 
CLUSTERL3HIT cpl5 |cl5 |0 c4 5 32-bit Cluster L3 hit counter register. 
CLUSTERL3MISS cpl5 |cl5 |0 c4 6 32-bit Cluster L3 miss counter register. 
CLUSTERTHREADSIDOVR |cp15 | cl5 [0 c4 7 32-bit Cluster thread scheme ID override register. 
CLUSTERPM* cpl5 |cl5 |0or6 | c5-c6 | 0-7 32-bit or 64-bit | Cluster PMU registers. 
Legacy feature registers 
Name Type | Description 
FCSEIDR | RO 

















B1.46 FCSEIDR, FCSE Process ID Register on page B1-198 


In Armv8-A, the core does not implement the FCSEIDR, and therefore the register is RO. 





Address registers 


























Name | Type | Description 
PAR |RW | 21.78 PAR, Physical Address Register on page B1-250 
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B1.5 ACTLR, Auxiliary Control Register 
The ACTLR provides access control for IMPLEMENTATION DEFINED registers at lower exception levels. 


ACTLR is a 32-bit register, and is part of: 
¢ The Other system control registers functional group. 
¢ The Implementation defined functional group. 


Bit field descriptions 
The core implements the ACTLR(NS) register, but has no defined bits. This register is always RESO. 
The following bit field descriptions are for the Secure version of the ACTLR. 











31 1312111098 765 4 210 
CLUSTERPMUEN e 
SMEN 
TSIDEN 
PWREN 
ERXPFGEN 
ECTLREN —~ 
ACTLREN 
RESO 


Figure B1-1 ACTLR (S) bit assignments 
RESO, [31:13] 
RESO Reserved. 
CLUSTERPMUEN, [12] 


Performance Management Registers enable. The value is: 


7) CLUSTERPM* registers are not write accessible from a lower Exception level. This is 
the reset value. 
1 CLUSTERPM* registers are write accessible from EL2. 
SMEN, [11] 


Scheme Management Registers enable. The value is: 


) Registers CLUSTERTHREADSID, CLUSTERACPSID, CLUSTERSTASHSID, 
CLUSTERPARTCR, and CLUSTERBUSQOS are not write accessible from EL2. This 
is the reset value. 


1 Registers controlled by the TSIDEN bit, CLUSTERACPSID, CLUSTERSTASHSID, 
CLUSTERPARTCR, and CLUSTERBUSQOS are write accessible from EL2. 


TSIDEN, [10] 
Thread Scheme ID Register enable. The possible values are: 


@ Register CLUSTERTHREADSID is not accessible from EL1 nonsecure. This is the 
reset value. 
1 Register CLUSTERTHREADSID is accessible from EL1 nonsecure if they are write 


accessible from EL2. 
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B1.5 ACTLR, Auxiliary Control Register 


RESO, [9:8] 
RESO Reserved. 
PWREN, [7] 
Power Control Registers enable. The value is: 


@ Registers CPUPWRCTLR, CLUSTERPWRCTLR, CLUSTERPWRDN, 
CLUSTERPWRSTAT, CLUSTERL3HIT and CLUSTERL3MISS are not write 
accessible from a lower Exception level. This is the reset value. 


1 Registers CPUPWRCTLR, CLUSTERPWRCTLR, CLUSTERPWRDN, 
CLUSTERPWRSTAT, CLUSTERL3HIT and CLUSTERL3MISS are write accessible 
from EL2. 

RESO, [6] 


RESO Reserved. 


ERXPFGEN, [5] 


Error Record Registers enable. The value is: 


) ERXPFG* are not write accessible from a lower Exception level. This is the reset 
value. 
1 ERXPFG* are write accessible from EL2. 
RESO, [4:2] 


RESO Reserved. 


ECTLREN, [1] 


Extended Control Registers enable. The value is: 


() CPUECTLR and CLUSTERECTLR are not write accessible from a lower Exception 
level. This is the reset value. 
1 CPUECTLR and CLUSTERECTLR are write accessible from EL2. 


ACTLREN, [0] 


Auxiliary Control Registers enable. The value is: 


7) CPUACTLR and CLUSTERACTLR are not write accessible from a lower Exception 
level. This is the reset value. 
1 CPUACTLR and CLUSTERACTLR are write accessible from EL2. 
Configurations 


AArch32 register ACTLR(NS) is mapped to AArch64 register ACTLR_EL1. See 
B2.5 ACTLR_ELI, Auxiliary Control Register, ELI on page B2-304. 


AArch32 register ACTLR(S) is mapped to AArch64 register ACTLR_EL3. See 
B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 on page B2-307. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.6 ACTLR2, Auxiliary Control Register 2 


The ACTLR2 provides extra space to the ACTLR register to hold IMPLEMENTATION DEFINED trap 
functionality for execution at EL1 and ELO. 


Bit field descriptions 
ACTLR2 is a 32-bit register, and is part of: 


¢ The Other system control registers functional group. 
¢ The Implementation defined functional group. 


31 0 


Lae 


RESO 


Figure B1-2 ACTLR2 bit assignments 
RESO, [31:0] 
RESO Reserved. 
Configurations 


AArch32 System register ACTLR2 is architecturally mapped to AArch64 System register 
ACTLR_EL1[63:32]. See B2.5 ACTLR_EL1, Auxiliary Control Register, ELI on page B2-304. 


AArch32 register ACTLR2(S) is architecturally mapped to AArch64 register 
ACTLR_EL3[63:32]. See B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 on page B2-307. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.7 ADFSR, Auxiliary Data Fault Status Register 


The ADFSR provides extra IMPLEMENTATION DEFINED fault status information for Data Abort exceptions 
taken to EL1 modes. In the Cortex-A55 core, no additional information is provided for such exceptions, 
so this register is not used. 


Bit field descriptions 
ADFSR is a 32-bit register, and is part of: 


¢ The Exception and fault handling registers functional group. 
¢ The Implementation defined functional group. 


31 0 


Pt 


RESO 


Figure B1-3 ADFSR bit assignments 
[31:0] 
Reserved, RESO. 
Configurations 


AArch32 System register ADFSR is architecturally mapped to AArch64 System register 
AFSRO_ ELI. See B2.8 AFSRO_EL1, Auxiliary Fault Status Register 0, ELI on page B2-309. 


AArch32 register ADFSR(S) is architecturally mapped to AArch64 register AFSRO_EL3. See 
B2.10 AFSRO_EL3, Auxiliary Fault Status Register 0, EL3 on page B2-311. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.8 AHTCR, Auxiliary Hypervisor Translation Control Register 


The AHTCR determines the values of the Page Based Hardware Attribute (PBHA) on page table walks 
memory access in hypervisor translation regime. 


Bit field descriptions 
AHTCR is a 32-bit register. 


31 109 87 210 
HWVAL60 —! L_HWEN59 
RESO HWVAL59 HWEN60 


Figure B1-4 AHTCR bit assignments 
[31:10] 
RESO. 


HWVALO6O, [9] 
Indicates the value of PBHA[1] page table walks memory access if HWEN60 is set. 


HWVALSS, [8] 

Indicates the value of PBHA[1] page table walks memory access if HWENSS9 is set. 
[7:2] 

RESO. 


HWEN6O0, [1] 


Enables PBHA[1] page table walks memory access. If this bit is clear, PBHA[1] on page table 
walks is 0. 


HWENSS, [0] 


Enables PBHA[0] page table walks memory access. If this bit is clear, PBHA[0] on page table 
walks is 0. 


Configurations 
AArch32 register AHTCR is mapped to AArch64 register TCR_EL2. 
Usage constraints 
Accessing the AHTCR 
This register can be read using MRC with the following syntax: 
MRC <syntax> 
This register can be written using MCR with the following syntax: 


MCR <syntax> 





<Syntax> Coproc | opc1 | CRn | CRm | opc2 























p15, 4, <Rt , cl5,c7,0| 1111 100 |1111 }0111 | 000 
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Accessibility 
AHTCR is accessible as follows: 


B1 AArch32 system registers 
B1.8 AHTCR, Auxiliary Hypervisor Translation Control Register 






































<syntax> Control Accessibility 

E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 4, <Rt>, c15, c7, 0 x x 0 - - n/a RW 
pls, 4, <Rt,cl5,c7,0 |x 0 1 2 = RW |RW 
pls, 4, <Rt,cl5,c7,0 |x 1 1 é nia |RW |RW 











Traps and enables 


The traps and enables that apply to this register are the same traps and enables that apply to 


HTCR. 
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B1.9 AIDR, Auxiliary ID Register 


The AIDR provides IMPLEMENTATION DEFINED identification information. This register is not used in the 
Cortex-A55 core. 


Bit field descriptions 

AIDR is a 32-bit register, and is part of: 

¢ The Identification registers functional group. 
¢ The Implementation defined functional group. 


31 0 


RESO 


Figure B1-5 AIDR bit assignments 
RESO, [31:0] 
Reserved, RESO. 
Configurations 
There is one instance of this register that is used in both Secure and Non-secure states. 


AArch32 System register AIDR is architecturally mapped to AArch64 System register 
AIDR_ELI. See B2./4 AIDR_ELI, Auxiliary ID Register, ELI on page B2-315. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.10 AIFSR, Auxiliary Instruction Fault Status Register 


The AIFSR provides extra IMPLEMENTATION DEFINED fault status information for Prefetch Abort exceptions 
that are taken to EL1 modes. This register is not used in the Cortex-A55 core. 


Bit field descriptions 
AIFSR is a 32-bit register, and is part of: 


¢ The Exception and fault handling registers functional group. 
¢ The Implementation defined functional group. 


31 0 


a 


RESO 


Figure B1-6 AIFSR bit assignments 
RESO, [31:0] 
RESO Reserved. 
Configurations 


AArch32 System register AIFSR is architecturally mapped to AArch64 System register 
AFSR1 ELI. See B2.// AFSRI_EL1, Auxiliary Fault Status Register 1, EL] on page B2-312. 


AArch32 System register AIFSR(S) is architecturally mapped to AArch64 System register 
AFSR1_EL3. See B2.13 AFSRI_EL3, Auxiliary Fault Status Register 1, EL3 on page B2-314. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-140 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.11 AMAIRO, Auxiliary Memory Attribute Indirection Register 0 


B1.11 AMAIRO, Auxiliary Memory Attribute Indirection Register 0 


When using the Long-descriptor format translation tables for stage | translations, AMAIRO provides 
IMPLEMENTATION DEFINED memory attributes for the memory regions specified by MAIRO. This register is 
not used in the Cortex-A55 core. 


Bit field descriptions 
AMAIRO is a 32-bit register, and is part of: 


¢ The Virtual memory control registers functional group. 
¢ The Implementation defined functional group. 


31 0 


Pt 


RESO 


Figure B1-7 AMAIRO bit assignments 
RESO, [31:0] 


RESO Reserved. 


Configurations 


AArch32 System register AMAIRO is architecturally mapped to AArch64 System register 
AMAIR_ EL1[31:0]. See B2./5 AMAIR_ELI, Auxiliary Memory Attribute Indirection Register, 
EL1 on page B2-316. 


AArch32 System register AMAIRO(S) is architecturally mapped to AArch64 System register 
AMAIR_ EL3[31:0]. See B2./7 AMAIR_EL3, Auxiliary Memory Attribute Indirection Register, 
EL3 on page B2-318. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.12 AMAIR1, Auxiliary Memory Attribute Indirection Register 1 


When using the Long-descriptor format translation tables for stage | translations, AMAIR1 provides 
IMPLEMENTATION DEFINED memory attributes for the memory regions specified by MAIRI. This register is 
not used in the Cortex-A55 core. 


Bit field descriptions 
AMAIR1 is a 32-bit register, and is part of: 


¢ The Virtual memory control registers functional group. 
¢ The Implementation defined functional group. 


31 0 


Pt 


RESO 
Figure B1-8 AMAIR1 bit assignments 


RESO, [31:0] 


RESO Reserved. 


Configurations 


AArch32 System register AMAIRI is architecturally mapped to AArch64 System register 
AMAIR_ EL1[63:32]. See B2.1/5 AMAIR_ ELI, Auxiliary Memory Attribute Indirection Register, 
EL1 on page B2-316. 


AArch32 System register AMAIRI(S) is architecturally mapped to AArch64 System register 
AMAIR_ EL3[63:32]. See B2.17 AMAIR_EL3, Auxiliary Memory Attribute Indirection Register, 
EL3 on page B2-318. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-142 
reserved. 
Non-Confidential 
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B1.13 ATTBCR, Auxiliary Translation Table Base Control Register 


B1.13 ATTBCR, Auxiliary Translation Table Base Control Register 
The ATTBCR determines the values of PBHA on page table walks memory access in EL] translation 
regime. 
Bit field descriptions 
ATTBCR is a 32-bit register. 


31 14131211109 876543 210 


HWVAL160 —! L_HWENO059 
= HWVAL159 HWENO60 
HWVALO60 HWEN159 


HWVALO059 HWEN160 


Figure B1-9 ATTBCR bit assignments 
[31:14] 
RESO. 


HWVAL160, [13] 


Indicates the value of PBHA[1] on page table walks memory access targeting the base address 
defined by TTB1 if HWEN160 is set. 


HWVAL1S59, [12] 


Indicates the value of PBHA[0] on page table walks memory access targeting the base address 
defined by TTB1 if HWEN159 is set. 


[11:10] 
RESO. 


HWVAL060, [9] 


Indicates the value of PBHA[1] page table walks memory access targeting the base address 
defined by TTBO if HWEN060 is set. 


HWVAL0S59, [8] 


Indicates the value of PBHA[1] page table walks memory access targeting the base address 
defined by TTBO if HWENO0S9 is set. 


[7:6] 
RESO. 


HWEN160, [5] 


Enables PBHA[1] page table walks memory access targeting the base address defined by 
TTB1. If this bit is clear, PBHA[1] on page table walks is 0. 


HWENI159, [4] 


Enables PBHA[0] page table walks memory access targeting the base address defined by 
TTB1. If this bit is clear, PBHA[0] on page table walks is 0. 


[3:2] 
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RESO. 


HWENO060, [1] 


Enables PBHA[1] page table walks memory access targeting the base address defined by 
TTBO. If this bit is clear, PBHA[1] on page table walks is 0. 


HWENDS9, [0] 


Enables PBHA[0] page table walks memory access targeting the base address defined by 
TTBO. If this bit is clear, PBHA[0] on page table walks is 0. 


Configurations 
AArch32 ATTBCR(NS) is architecturally mapped to AArch64 register ATCR_EL1. 
AArch32 ATTBCR(S) is architecturally mapped to AArch64 register ATCR_EL3. 
If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


On a Warm reset, the Secure instance of ATTBCR resets to @x@. 


Usage constraints 
Accessing the ATTBCR 
This register can be read using MRC with the following syntax: 
MRC <syntax> 
This register can be written using MCR with the following syntax: 


MCR <syntax> 





<Syntax> coproc | opc1 | CRn | CRm | ocp2 





p15, 0,<Rt>, cl5,c7,0]1111 [000 | 1111 } 0111 | 000 























Accessibility 


If EL3 is implemented and is using AArch32, there are separate instances of this register and 
ATTBCR is accessible as follows: 

















<syntax> Control Accessibility Insta 
nce 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 0, <Rt>,cl5,c7,0 |x x 0 - RW |n/a |RW_ |SCTL 
RS 
pl5, 0, <Rt>,c15,c7,0 |x 0 1 - RW RW RW SCTL 
R_NS 
p15, 0, <Rt>,cl5,c7,0 |x 1 1 - wa |RW |RW_ |SCTL 
R_NS 



































Traps and enables 
Rules of trap and enable for this register are the same as TTBCR. See the Arm® Architecture 
Reference Manual Armvé, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.14 AVTCR, Auxiliary Virtualized Translation Control Register 


B1.14 AVTCR, Auxiliary Virtualized Translation Control Register 


The AVTCR determines the values of PBHA on stage 2 page table walks memory access in EL] Non- 
secure translation regime if stage 2 is enabled. 


Bit field descriptions 
AVTCR is a 32-bit register. 


31 109 87 210 
HWVAL60 —! L_HWEN59 
RESO HWVAL59 HWEN60 


Figure B1-10 AVTCR bit assignments 
[31:10] 
RESO. 


HWVALO6O, [9] 
Indicates the value of PBHA[1] page table walks memory access if HWEN60 is set. 


HWVALSS, [8] 

Indicates the value of PBHA[1] page table walks memory access if HWENS9 is set. 
[7:2] 

RESO. 


HWENOO, [1] 


Enables PBHA[1] page table walks memory access. If this bit is clear, PBHA[1] on page table 
walks is 0. 


HWENSS, [0] 


Enables PBHA[0] page table walks memory access. If this bit is clear, PBHA[0] on page table 
walks is 0. 


Configurations 


AArch32 register AVTCR is architecturally mapped to AArch64 register AVTCR_EL2. 


Usage constraints 
Accessing the AVTCR 
This register can be read using MRC with the following syntax: 
MRC <syntax> 
This register can be written using MCR with the following syntax: 


MCR <syntax> 





Syntax coproc | opci1 | CRn | CRm | opc2 























p15, 4, <Rt>, cl5, 7,1] 1111 100 | 1111 }0111 | 001 
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Accessibility 
AVTCR is accessible as follows: 
<syntax> Control Accessibility 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 4, <Rt>, c15, c7, 1 x x 0 - - n/a RW 
pls, 4, <Rt>,cl5,c7,1 |x 0 1 2 = RW |RW 
pls, 4, <Rt>,cl5,c7,1 |x 1 1 é na |RW [RW 
B1-146 


100442 _0200_00_en 


Copyright © 2016-2018 Arm Limited or its affiliates. All rights 


reserved. 


Non-Confidential 


B1 AArch32 system registers 
B1.15 CCSIDR, Cache Size ID Register 


B1.15 CCSIDR, Cache Size ID Register 


The CCSIDR provides information about the architecture of the currently selected cache. 


Bit field descriptions 
CCSIDR is a 32-bit register and is part of the Identification registers functional group. 
This register is Read Only. 


31 30 29 28 27 13 12 3 2 0 


| NumSets Associativity 
wt — L_ WA LineSize —! 
WB RA 


Figure B1-11 CCSIDR bit assignments 





WT, [31] 
Indicates whether the selected cache level supports Write-Through: 
) Cache Write-Through is not supported at any level. 


For more information about encoding, see Zable B1-6 CCSIDR encodings 
on page B1-148. 


WB, [30] 
Indicates whether the selected cache level supports Write-Back. Permitted values are: 
) Write-Back is not supported. 
1 Write-Back is supported. 


For more information about encoding, see Zable BI-6 CCSIDR encodings 
on page B1-148. 


RA, [29] 
Indicates whether the selected cache level supports read-allocation. Permitted values are: 
) Read-allocation is not supported. 
1 Read-allocation is supported. 


For more information about encoding, see Zable B/-6 CCSIDR encodings 
on page B1-148. 


WA, [28] 
Indicates whether the selected cache level supports write-allocation. Permitted values are: 
) Write-allocation is not supported. 
1 Write-allocation is supported. 


For more information about encoding, see Zable B/-6 CCSIDR encodings 
on page B1-148. 
NumSets, [27:13] 


(Number of sets in cache) - 1. Therefore, a value of 0 indicates one set in the cache. The number 
of sets does not have to be a power of 2. 


For more information about encoding, see Zable BI-6 CCSIDR encodings on page B1-148. 
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Associativity, [12:3] 


(Associativity of cache) - 1. Therefore, a value of 0 indicates an associativity of 1. The 


associativity does not have to be a power of 2. 


B1 AArch32 system registers 
B1.15 CCSIDR, Cache Size ID Register 


For more information about encoding, see Zable B/-6 CCSIDR encodings on page B1-148. 
LineSize, [2:0] 


(Log>(Number of bytes in cache line)) - 4. For example: 


Indicates the (logy (number of words in cache line)) - 2: 


For a line length of 16 bytes: Log2(16) = 4, LineSize entry = 0. This is the minimum 
line length. 


For a line length of 32 bytes: Log»(32) = 5, LineSize entry = 1. 


For more information about encoding, see Zable BI-6 CCSIDR encodings on page B1-148. 


Configurations 


CCSIDR is architecturally mapped to AArch64 register CCSIDR_EL1. See 


B2.23 CCSIDR_EL1, Cache Size ID Register, ELI on page B2-328. 


There is one copy of this register that is used in both Secure and Non-secure states. 


The implementation includes one CCSIDR for each cache that it can access. CSSELR selects 


which Cache Size ID Register is accessible. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 


Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


CCSIDR encodings 


The following table shows the individual bit field and complete register encodings for the CCSIDR. The 
CSSELR determines which CCSIDR to select. 


Table B1-6 CCSIDR encodings 

































































CSSELR Cache Size Complete Register bit field encoding 
register 
Level InD 2 : WT |WB |RA_ |WA_|NumSets | Associativity | LineSize 
encoding 
@beee Q@be LI Data 16KB 7007EQ1A Q 1 1 1 Q03F 003 
pacts 32KB | 70@FEQ1A Q07F 203 
64KB 7O1FEQ1A QQFF 003 
e@beee Q@b1 Ll 16KB 2007EQ1A Q Q 1 Q Q03F 003 
Instruction | 35xp | 20@FEO1A Q07F 203 
cache 
64KB 201FEQ1A QQOFF 003 
Qbee1 Q@be L2 cache Not See - - - - - - 
present | following 
Note. 
64KB 7O1FEQ1A Q 1 1 1 QOFF 003 
128KB 703FEQ1A Q1FF 003 
256KB 707FEQ1A Q@3FF e003 
0bee1 Qb1 Reserved - - - - - - - - 









































100442 _0200_00 en 


Copyright © 2016-2018 Arm Limited or its affiliates. All rights 
reserved. 


Non-Confidential 


B1-148 


B1 AArch32 system registers 


B1.15 CCSIDR, Cache Size ID Register 


Table B1-6 CCSIDR encodings (continued) 






















































































CSSELR Cache Size Complete | Register bit field encoding 
Level |InD ei wt /we |RA_ |WA_ |NumSets | Associativity | LineSize 
@be10 @be L3 cache 256KB | 701FE07A Q 1 1 1 QQOF OOF 2 
512KB_ | 703FEQ7A Q1FF GOF 2 
1MB 707FEQ7A O3FF GOF 2 
2MB 7OFFEQ7A O7FF GOF 2 
4MB 71FFEQ7A OFFF GOF 2 
8MB 73FFEQ7A 1FFF GQOF 2 
0be101 - Reserved - - - - - - - - - 
@b1111 
Note 





If no L2 cache is present the core uses L3 cache as L2, and the L3 encodings apply. 
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B1 AArch32 system registers 
B1.16 CLIDR, Cache Level ID Register 


B1.16 CLIDR, Cache Level ID Register 


The CLIDR identifies the type of cache, or caches, implemented at each level, up to a maximum of seven 
levels. 


It also identifies the Level of Coherency (LoC) and Level of Unification (LoU) for the cache hierarchy. 


Bit field descriptions 
CLIDR is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


313029 2726 2423 2120 1817 +1514 1211 9 8 6 5 3 2 0 





RESO 


Figure B1-12 CLIDR bit assignments 
ICB, [31:30] 
Inner cache boundary. This field indicates the boundary between the inner and the outer domain: 
@b1@ ~L2 cache is the highest inner level. 
@b11 ~L3 cache is the highest inner level. 
LoUU, [29:27] 
Indicates the Level of Unification Uniprocessor for the cache hierarchy: 


@beeee No levels of cache need to cleaned or invalidated when cleaning or invalidating to the 
Point of Unification. This is the value if no cache are configured. 


LoC, [26:24] 
Indicates the Level of Coherency for the cache hierarchy: 


@be1@ ~ L3 cache is not implemented. 
@be@11 L2 and L3 cache are implemented. 


LoUIS, [23:21] 
Indicates the Level of Unification Inner Shareable (LoUIS) for the cache hierarchy. 


@beee No levels of cache need to cleaned or invalidated when cleaning or invalidating to the 
Point of Unification. 


RESO, [20:9] 
No cache at levels L7 down to L4. 
RESO Reserved. 

Ctype3, [8:6] 


Indicates the type of cache if the cluster implements L3 cache. If present, unified instruction and 
data caches at Level-3: 


@beee = L3 cache is not implemented. 
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B1.16 CLIDR, Cache Level ID Register 


@b10@ L3 cache is implemented. 


If Ctype2 has a value of @b@@@, the value of Ctype3 must be ignored. 
Ctype2, [5:3] 


Indicates the type of cache if the core implements L2 cache. If present, unified instruction and 
data caches at Level-2: 


@b10@ L2 cache is implemented as a unified cache. 
Ctypel, [2:0] 
Indicates the type of cache implemented at L1: 


@b@11 Separate instruction and data caches at L1. 


Configurations 


CLIDR is architecturally mapped to AArch64 register CLIDR_EL1. See 82.24 CLIDR_ELI, 
Cache Level ID Register, ELI on page B2-331. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.17 CPACR, Architectural Feature Access Control Register 


B1.17  CPACR, Architectural Feature Access Control Register 


The CPACR controls access to floating-point, and Advanced SIMD functionality from ELO, EL1, and 
EL3. 


Bit field descriptions 


CPACR is a 32-bit register, and is part of the Other system control registers functional group. 


31 30 29 28 27 24 23 22 21 2019 0 


| L_TRODIS 
ASEDIS 


RESO 


Figure B1-13 CPACR bit assignments 
TRCDIS, [28] 
This bit is reserved, RESO. 
Configurations 


CPACR is architecturally mapped to AArch64 register CPACR_EL1. See 82.25 CPACR_ELI, 
Architectural Feature Access Control Register, ELI on page B2-333. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bits in the NSACR control Non-secure access to the CPACR fields. See the field descriptions 
cp10 and cp11. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.18 CPUACTLR, CPU Auxiliary Control Register 


The CPUACTLR provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 
CPUACTLR is a 64-bit register, and is part of the Implementation defined registers functional group. 


63 0 


Reserved 


Figure B1-14 CPUACTLR bit assignments 


Reserved, [63:0] 


Reserved for Arm internal use. 


Configurations 
CPUACTLR is: 


* Common to the Secure and Non-secure states. 
¢ Mapped to the AArch64 CPUACTLR_ ELI register. See B2.28 CPUACTLR_EL1, CPU 


Auxiliary Control Register, EL1 on page B2-336. 
Usage constraints 
Accessing the CPUACTLR 


Arm recommends that you write to this register after a powerup reset, before the MMU is 
enabled. 


Setting many of these bits can cause significantly lower performance on your code. Therefore, 
Arm strongly recommends that you do not modify this register unless directed by Arm. 


This register can be read using MRRC with the following syntax: 
MRRC <syntax> 

This register can be written using MCRR with the following syntax: 
MCRR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opc1 | CRm 














p15, 0, <Rt, <Rt2>,c15/1111 | 0000 | 1111 








Accessibility 


This register is accessible in software as follows: 























<syntax> Control Accessibility 

E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 0, <Rt, <Rt2>,cl5 |x x 0 3 RW |n/a |RW 
p15, 0, <Rt, <Rt2>,cl5 |x 0 1 2 RW |RW |RW 
p15, 0, <Rt, <Rt2>,cl5 |x 1 1 - nia |RW |RW 


























‘n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-153 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.18 CPUACTLR, CPU Auxiliary Control Register 


Traps and enables 
For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. 


Write access to this register from EL1 or EL2 depends on the value of bit[0] of ACTLR_EL2, 
ACTLR_EL3, ACTLR (S), and HACTLR. 
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CPUCFR, CPU Configuration Register 


The CPUCER provides configuration information for the core. 


Bit field descriptions 
CPUCER is a 32-bit register and is part of the Implementation registers functional group. 


This register is Read Only. 


31 3210 
ss | 
L—scu 

RESO 


Figure B1-15 CPUCFR bit assignments 
RESO, [31:3] 


RESO Reserved. 


SCU, [2] 
Indicates whether the SCU is present or not. The value is: 
0 The SCU is present. 
ECC, [1:0] 
Indicates whether ECC is present or not. The possible values are: 
0 ECC is not present. 
1 ECC is present. 
Configurations 


CPUCER is architecturally mapped to AArch64 register CPUCFR_EL1. See 
B2.29 CPUCFR_EL1, CPU Configuration Register, ELI on page B2-338. 


Usage constraints 
Accessing the CPUCFR 
This register can be read using MRC with the following syntax: 
MRC <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opci1 | CRn | CRm | opc2 





p15, 0, <Rt>, cl5,c0,0] 1111 |000 | 1111 | 0000 | 000 























Accessibility 


This register is accessible in software as follows: 
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B1 AArch32 system registers 
B1.19 CPUCFR, CPU Configuration Register 






































<syntax> Control Accessibility 

E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 0, <Rt>, c15, c0, 0 x x 0 - RO n/a RO 
p15, 0, <Rt>, c15, c0, 0 x 0 1 - RO RO RO 
p15, 0, <Rt>, c15, c0, 0 x 1 1 - n/a RO RO 











'n/a' Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 
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B1 AArch32 system registers 
B1.20 CPUECTLR, CPU Extended Control Register 


B1.20 CPUECTLR, CPU Extended Control Register 


The CPUECTLR provides extra IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 


CPUECTLR is a 64-bit register, and is part of the 64-bit registers functional group. 


63 40 39 38 37 36 31 30 29 28:27 26 25 24 1615 1312 109 10 


aaa E 


ATOM —_ Z Es EXTLLC 
L2FLUSH L3PCTL 





LIPCTL 
L3WSCTL 
L2WSCTL 
L1WSCTL 
RESO 
Figure B1-16 CPUECTLR bit assignments 
RESO, [63:40] 
RESO Reserved. 
ATOM, [39:38] 

ee Atomic instructions are performed near if they hit in the cache in a unique state, or far 
if they miss or are shared. For more details, see 46.4.1 Memory system implementation 
on page A6-80. This is the default. 

@1 Force all cacheable atomic instructions to be executed near, in the L1 cache. 

10 Force most cacheable atomic instructions to be executed far, in the L3 cache or 
beyond. 

11 Force cacheable load atomics, including SWP and CAS, to be executed near, in the L1 
cache. Store atomics are performed near if they hit in the cache in a unique state, or far 
if they miss or are shared. 

L2FLUSH, [37] 

) L2 cache flushes, for example during a core powerdown sequence, cause clean lines to 
be allocated into the L3 cache rather than discarding them. This can improve 
performance if it is known that the data is likely to be used soon by another core. 

1 Clean lines do not provide data when being evicted during a cache flush and do not 
allocate to the L3 cache. If the line is being evicted from the cluster, the DSU will 
generate evict transactions to update the interconnect snoop filter depending on the 
DSU programming. 

RESO, [36:31] 
RESO Reserved. 
L3WSCTL, [30:29] 

Write streaming no-L3-allocate threshold. The possible values are: 

ee 128th consecutive streaming cache line does not allocate in the L1, L2, or L3 cache. 

e@1 1024th consecutive streaming cache line does not allocate in the L1, L2, or L3 cache. 
This is the reset value. 
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B1.20 CPUECTLR, CPU Extended Control Register 


10 4096th consecutive streaming cache line does not allocate in the L1, L2, or L3 cache. 


11 Disables streaming. All write-allocate lines allocate in the L1, L2, or L3 cache. 


L2WSCTL, [28:27] 


Write streaming no-L2-allocate threshold. The possible values are: 
ee 16th consecutive streaming cache line does not allocate in the L1 or L2 cache. 


e1 128th consecutive streaming cache line does not allocate in the L1 or L2 cache. This is 
the reset value. 


10 512th consecutive streaming cache line does not allocate in the L1 or L2 cache. 


11 Disables streaming. All write-allocate lines allocate in the L1 or L2 cache. 


LIWSCTL, [26:25] 


Write streaming no-L1-allocate threshold. The possible values are: 


ee 4th consecutive streaming cache line does not allocate in the L1 cache. This is the 
reset value. 


Q1 64th consecutive streaming cache line does not allocate in the L1 cache. 
10 128th consecutive streaming cache line does not allocate in the L1 
11 Disables streaming. All write-allocate lines allocate in the L1 cache. 


RESO, [24:16] 


RESO Reserved. 


LIPCTL, [15:13] 


L1 Data prefetch control. The value of the LIPCTL field determines the maximum number of 
outstanding data prefetches allowed in the L1 memory system (not counting the data prefetches 
generated by software load/PLD instructions). 


eee Prefetch disabled. 

ee1 1 outstanding prefetch allowed. 

e108 2 outstanding prefetches allowed. 

e11 3 outstanding prefetches allowed. 

100 4 outstanding prefetches allowed. 

101 5 outstanding prefetches allowed. This is the reset value. 
110 6 outstanding prefetches allowed. 


111 7 outstanding prefetches allowed. 


L3PCTL, [12:10] 


L3 Data prefetch control. The value of the L3PCTL field determines the approximate distance 
between the L1 prefetcher and requests sent to the L3 memory system. Increasing this distance 
may improve performance on systems with higher latency to main memory, but increasing it too 
far can reduce performance. 

Note 


The L3 memory system may have more outstanding access to the system than this number. 








eee Fetch 16 lines ahead. 
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ee1 Fetch 32 lines ahead. 
e108 Reserved. 

@11 Reserved. 

100 Disable L3 prefetching. 
101 Fetch 2 lines ahead. 
110 Fetch 4 lines ahead. 


111 Fetch 8 lines ahead. This is the reset value. 


RESO, [9:1] 
RESO Reserved. 


EXTLLCG, [0] 


() Indicates that the L3 cache is the external Last-level cache in the system. This is the 
reset value. 


1 Indicates that an external Last-level cache is present in the system, and that the 
DataSource field on the master CHI interface indicates when data is returned from the 
LLC. This is used to control how the LL_CACHE* PMU events count. 
Configurations 


The CPUECTLR is mapped to the AArch64 CPUECTLR_ELI register. See 
B2.30 CPUECTLR_ELI, CPU Extended Control Register, EL] on page B2-340. 


Usage constraints 
Accessing the CPUECTLR 
The CPUECTLR can be written dynamically. 
This register can be read using MRRC with the following syntax: 
MRRC <syntax> 
This register can be written using MRRC with the following syntax: 
MCRR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opc1 | CRm 





pls, 4, <Rt, <Rt2>,c15]1111 | 0100 | 1111 

















Accessibility 


This register is accessible in software as follows: 

















<syntax> Control Accessibility 

E2H |TGE |NS ELO |EL1 |EL2 |EL3 
pls, 1, <Rt, <Rt2>,cl5 |x x 0 ? RW [n/a |RW 
pls, 1, <Rt, <Rt2>,cl5 |x 0 1 : RW |RW |RW 
pls, 1, <Rt, <Rt2>,cl5 |x 1 1 = nia |RW |RW 
































'n/a' Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-159 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.20 CPUECTLR, CPU Extended Control Register 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. 
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B1 AArch32 system registers 
B1.21 CPUPCR, CPU Private Control Register 


B1.21 CPUPCR, CPU Private Control Register 


The CPUPCR provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 
CPUPCR is a 64-bit register, and is part of the Implementation defined registers functional group. 


63 0 


Reserved 


Figure B1-17 CPUPCR bit assignments 


Reserved, [63:0] 


Reserved for Arm internal use. 


Configurations 
CPUPCR is: 


¢ Only accessible in Secure state. 
¢ Mapped to the AArch64 CPUPCR_EL3 register. See B2.3/ CPUPCR_EL3, CPU Private 


Control Register, EL3 on page B2-343. 
Usage constraints 
Accessing the CPUPCR 


Arm recommends that you write to this register after a powerup reset, before the MMU is 
enabled. 


Writing to this register might cause UNPREDICTABLE behaviors. Therefore, Arm strongly 
recommends that you do not modify this register unless directed by Arm. 


This register can be read using MRRC with the following syntax: 
MRRC <syntax> 

This register can be written using MCRR with the following syntax: 
MCRR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opc1 | CRm 














p15, 8, <Rt, <Rt2>,c15| 1111 1000 | 1111 























Accessibility 
This register is accessible in software as follows: 
<syntax> Control Accessibility 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
pls, 8, <Rt>, <Rt2>,c15 |x x 0 - - n/a RW 
p15, 8, <Rt>, <Rt2>,cl5 |x 0 1 : < RW 
p15, 8, <Rt>, <Rt2>,cl5 |x 1 1 - na ‘|- RW 
































‘n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 
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B1 AArch32 system registers 
B1.21 CPUPCR, CPU Private Control Register 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. 
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B1 AArch32 system registers 
B1.22 CPUPMR, CPU Private Mask Register 


B1.22 CPUPMR, CPU Private Mask Register 


The CPUPMR provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 


CPUPMR is a 64-bit register, and is part of the Implementation defined registers functional group. 


63 0 


Reserved 


Figure B1-18 CPUPMR bit assignments 
Reserved, [63:0] 


Reserved for Arm internal use. 


Configurations 
CPUPMR is: 


¢ Only accessible in Secure state. 
¢ Mapped to the AArch64 CPUPMR _EL3 register. See B2.32 CPUPMR_EL3, CPU Private 
Mask Register, EL3 on page B2-345. 


Usage constraints 
Accessing the CPUPOR 


Arm recommends that you write to this register after a powerup reset, before the MMU is 
enabled. 


Writing to this register might cause UNPREDICTABLE behaviors. Therefore, Arm strongly 
recommends that you do not modify this register unless directed by Arm. 


This register can be read using MRRC with the following syntax: 
MRRC <syntax> 
This register can be written using MCRR with the following syntax: 


MCRR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opc1 | CRm 





p15, 10, <Rt>, <Rt2>, c15} 1111 1010 | 1111 

















Accessibility 


This register is accessible in software as follows: 
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B1 AArch32 system registers 
B1.22 CPUPMR, CPU Private Mask Register 






































<syntax> Control Accessibility 

E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 10, <Rt>, <Rt2>, x x 0 - - n/a RW 
cl5 
p15, 10, <Rt>, <Rt2>, x 0 1 Z s z RW 
cl5 
p15, 10, <Rt>, <Rt2>, x 1 1 = wa |- RW 
cl5 











'n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 


in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 


exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 


taken to AArch64 state. 
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B1 AArch32 system registers 
B1.23 CPUPOR, CPU Private Operation Register 


B1.23 CPUPOR, CPU Private Operation Register 
The CPUPOR provides IMPLEMENTATION DEFINED configuration and control options for the core. 
Bit field descriptions 


CPUPOR is a 64-bit register, and is part of the Implementation defined registers functional group. 


63 0 


Reserved 


Figure B1-19 CPUPOR bit assignments 
Reserved, [63:0] 


Reserved for Arm internal use. 


Configurations 
CPUPOR is: 
¢ Only accessible in Secure state. 
« Mapped to the AArch64 CPUPOR _EL3 register. See B2.33 CPUPOR_EL3, CPU Private 
Operation Register, EL3 on page B2-347. 


Usage constraints 
Accessing the CPUPOR 


Arm recommends that you write to this register after a powerup reset, before the MMU is 
enabled. 


Writing to this register might cause UNPREDICTABLE behaviors. Therefore, Arm strongly 
recommends that you do not modify this register unless directed by Arm. 


This register can be read using MRRC with the following syntax: 
MRCC <syntax> 
This register can be written using MCRR with the following syntax: 


MCRR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opc1 | CRm 





p15, 9, <Rt>, <Rt2>, c15} 1111 1001 | 1111 

















Accessibility 


This register is accessible in software as follows: 
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B1 AArch32 system registers 
B1.23 CPUPOR, CPU Private Operation Register 



































<syntax> Control Accessibility 
E2 |TG|NS|EL | EL | EL /EL 
H |E 0 |1 |2 #413 
p15, 9, <Rt>, <Rt2>, c15 x x 0 - - n/a |R 
W 
p15, 9, <Rt>, <Rt2>, c15 x 0 1 - - - R 
WwW 
p15, 9, <Rt>, <Rt2>, c15 x 1 1 - n/a |- R 
WwW 














‘n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 


taken to AArch64 state. 
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B1 AArch32 system registers 
B1.24 CPUPSELR, CPU Private Selection Register 


B1.24 CPUPSELR, CPU Private Selection Register 


The CPUPSELR provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 
CPUPSELR is a 32-bit register, and is part of the Implementation defined registers functional group. 


31 0 


Figure B1-20 CPUPSELR bit assignments 
Reserved, [31:0] 


Reserved for Arm internal use. 


Configurations 
CPUPSELR is: 


¢ Only accessible in Secure state. 
¢ Mapped to the AArch64 CPUPSELR_EL3 register. See B2.34 CPUPSELR_EL3, CPU 
Private Selection Register, EL3 on page B2-349. 
Usage constraints 
Accessing the CPUPSELR 


Arm recommends that you write to this register after a powerup reset, before the MMU is 
enabled. 


Writing to this register might cause UNPREDICTABLE behaviors. Therefore, Arm strongly 
recommends that you do not modify this register unless directed by Arm. 


This register can be read using MRC with the following syntax: 
MRC <syntax> 

This register can be written using MCR with the following syntax: 
MCR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opc1 | CRn | CRm | Opc2 




















p15, 6, <Rt>, cl5,c8, 0 1111 110 | 1111 | 1000 | 000 





Accessibility 


This register is accessible in software as follows: 














<syntax> Control Accessibility 

E2H | TGE | NS | ELO| EL1 | EL2 | EL3 
p15, 6, <Rt>, c15, c8, 0] x x 0 |- - n/a |RW 
p15, 6, <Rt>, c15, c8, 0| x 0 1 |- - - RW 
p15, 6, <Rt>, c15, c8, 0] x 1 1 - n/a |- RW 
































‘n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 
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B1 AArch32 system registers 
B1.24 CPUPSELR, CPU Private Selection Register 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. 
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B1 AArch32 system registers 
B1.25 CPUPWRCTLR, CPU Power Control Register 


B1.25 CPUPWRCTLR, CPU Power Control Register 
The CPUPWRCTLR is a configuration register that gives indications to the external power controller. 


Bit field descriptions 


CPUPWRCTLR is a 32-bit register, and is part of the Implementation registers functional group. 


31 1312 109 7 6 4 3 10 


WFI_RET_CTRL 
CORE_PWRDN_EN 


SIMD_RET_CTRL —! | 
WFE_RET_CTRL 
RESO 


Figure B1-21 CPUPWRCTLR bit assignments 
RESO, [31:13] 
RESO Reserved. 
SIMD_RET_CTRL, [12:10] 
Advanced SIMD and floating-point retention control: 


@beee Disable the retention circuit. This is the default value, see Zable B2-7 CPUPWRCTLR 
Retention Control Field on page B2-352 for more retention control options. 


WFE_RET_CTRL, [9:7] 
CPU WF E retention control: 


@beee Disable the retention circuit. This is the default value, see Zable BI1-7 CPUPWRCTLR 
Retention Control Field on page B1-170 for more retention control options. 


WFL RET_CTRL, [6:4] 
CPU WFI retention control: 


@beee Disable the retention circuit. This is the default value, see Zable B1-7 CPUPWRCTLR 
Retention Control Field on page B1-170 for more retention control options. 


RESO, [3:1] 
RESO Reserved. 
CORE_PWRDN EN, [0] 


Indicates to the power controller if the CPU wants to power down when it enters WFI state. 





@be No power down requested. 
@b1 A power down is requested. 
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B1 AArch32 system registers 


B1.25 CPUPWRCTLR, CPU Power Control Register 


Table B1-7 CPUPWRCTLR Retention Control Field 












































Encoding | Note Minimum Delay before retention 
50MHz — 10MHz 

e008 Disable the retention circuit. Default Condition. 

ee1 2 Architectural Timer ticks are required before retention entry. | 40ns — 200ns 

e010 8 Architectural Timer ticks are required before retention entry. 160ns — 800ns 

Q11 32 Architectural Timer ticks are required before retention entry. | 640ns — 3,200ns 

100 64 Architectural Timer ticks are required before retention entry. | 1,280ns — 6,400ns 

101 128 Architectural Timer ticks are required before retention entry. | 2,560ns — 12,800ns 

110 256 Architectural Timer ticks are required before retention entry. | 5,120ns — 25,600ns 

111 512 Architectural Timer ticks are required before retention entry. | 10,240ns — 51,200ns 

Configurations 


CPUPWRCTLR is architecturally mapped to AArch64 register CPUPWRCTLR_ELI. See 
B2.35 CPUPWRCTLR_EL1, Power Control Register, ELI on page B2-351. 


Usage constraints 
Accessing the CPUPWRCTLR 


This register can be read using MRC with the following syntax: 


MRC <syntax> 


This register can be written using MCR with the following syntax: 


MCR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> 


coproc | opci1 | CRn | CRm | opc2 





p15, 0, <Rt>, 15, c2,7 





1111 000 | 1111 | 0010 | 111 




















Accessibility 


This register is accessible in software as follows: 
<syntax> Control Accessibility 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 0, <Rt>, c15, c2, 7 x x 0 - RW n/a RW 
p15, 0, <Rt,cl5,c2,7. |x 0 1 é RW |RW {RW 
p15, 0, <Rt>,cl5,c2,7. |x 1 1 2 nia |RW |RW 















































‘n/a' Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 


taken to AArch64 state. 
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B1 AArch32 system registers 
B1.25 CPUPWRCTLR, CPU Power Control Register 


Write access to this register from EL1 or EL2 depends on the value of bit[7] of ACTLR_EL2, 
ACTLR_EL3, ACTLR (S), and HACTLR. 
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B1 AArch32 system registers 
B1.26 CSSELR, Cache Size Selection Register 


B1.26 CSSELR, Cache Size Selection Register 
The CSSELR selects the current CCSIDR by specifying: 


¢ The required cache level. 
¢ The cache type, either instruction or data cache. 


For details of the CCSIDR, see B/.15 CCSIDR, Cache Size ID Register on page B1-147. 


Bit field descriptions 


CSSELR is a 32-bit register, and is part of the Identification registers functional group. 


31 4 3 10 


inp! 


RESO 


Figure B1-22 CSSELR bit assignments 
RESO, [31:4] 
RESO Reserved. 
Level, [3:1] 
Cache level of required cache: 


e@bee0 Ll. 
@be01 L2. 


Only if L2 is present, or if no L2 present then L3 is present. 
@be10 L3. Only if L3 exists. 


The combination of Level=@be01 and InD=@b1 is reserved. 


The combinations of Level and InD for @b@10@ to @b1111 are reserved. 


InD, [0] 
Instruction not Data bit: 
@be Data or unified cache. 
@b1 Instruction cache. 


The combination of Level=@be01 or Level=@b010 and InD=@b1 is reserved. 
The combinations of Level and InD for @b@10@ to @b1111 are reserved. 
Configurations 
CSSELR (NS) is architecturally mapped to AArch64 register CSSELR_EL1. See 
B2.36 CSSELR_EL1, Cache Size Selection Register, ELI on page B2-354. 
If a cache level is missing but CSSELR selects this level, then CCSIDR is L1 cache as CSSERL 
is RESO for all bits when programmed with a cache level which does not exist. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.27 CTR, Cache Type Register 


CTR, Cache Type Register 


The CTR provides information about the architecture of the caches. 


Bit field descriptions 
CTR is a 32-bit register, and is part of the Identification registers functional group. 


This register is Read Only. 


3130 2827 24 23 20 19 16 15 14 13 4 3 0 





RES1 
RESO 
Figure B1-23 CTR bit assignments 
RES1, [31] 
RES1 Reserved. 


RESO, [30:28] 
RESO Reserved. 
CWG, [27:24] 


Cache Write-Back granule. Log, of the number of words of the maximum size of memory that 
can be overwritten as a result of the eviction of a cache entry that has had a memory location in 
it modified: 


@be10@ Cache Write-Back granule size is 16 words. 


ERG, [23:20] 


Exclusives Reservation Granule. Log, of the number of words of the maximum size of the 
reservation granule that has been implemented for the Load-Exclusive and Store-Exclusive 
instructions: 


@be1ee Exclusive reservation granule size is 16 words. 
DminLine, [19:16] 


Log, of the number of words in the smallest cache line of all the data and unified caches that the 
core controls: 


@be10e Smallest data cache line size is 16 words. 

L1Ip, [15:14] 
Instruction cache policy. Indicates the indexing and tagging policy for the L1 Instruction cache: 
@b10 ~=—-“ Virtually Indexed Physically Tagged (VIPT). 

RESO, [13:4] 


RESO Reserved. 


IminLine, [3:0] 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-173 


reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.27 CTR, Cache Type Register 


Log, of the number of words in the smallest cache line of all the instruction caches that the core 
controls. 


@be10@ Smallest instruction cache line size is 16 words. 


Configurations 


CTR is architecturally mapped to AArch64 register CTR_ELO. See B2.37 CTR_ELO, Cache 
Type Register, ELO on page B2-355. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-174 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.28 DFSR, Data Fault Status Register 


B1.28 DFSR, Data Fault Status Register 


The DFSR holds status information about the last data fault. 


Bit field descriptions 
DFSR is a 32-bit register, and is part of the Exception and fault handling registers functional group. 


There are two formats for this register. The current translation table format determines which format of 
the register is used. 

¢ B1.28.1 DFSR with Short-descriptor translation table format on page B1-175. 

¢ B1.28.2 DFSR with Long-descriptor translation table format on page B1-175. 


Configurations 


DFSR (NS) is architecturally mapped to AArch64 register ESR_EL1. See B2.5/ ESR_ELI, 
Exception Syndrome Register, ELI on page B2-373. 


DFSR (S) is architecturally mapped to AArch64 register ESR_EL3. See 82.53 ESR_EL3, 
Exception Syndrome Register, EL3 on page B2-375. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 
¢ B1.28.1 DFSR with Short-descriptor translation table format on page B1-175. 
¢ B1.28.2 DFSR with Long-descriptor translation table format on page B1-175. 


B1.28.1 | DFSR with Short-descriptor translation table format 
DFSR has a specific format when using the Short-descriptor translation table format. 


The following figure shows the DFSR bit assignments when using the Short-descriptor translation table 
format. 


When TTBCR.EAE==0: 


31 1716.1514131211109 8.7 4:3 0. 





Fnv — L__ [PAE 
FS/4] 
WnR 


CM 


RESO 
Figure B1-24 DFSR bit assignments for Short-descriptor translation table format 


AET, [15:14] 


Asynchronous Error Type. Describes the state of the PE after taking an asynchronous Data 
Abort exception. The value is: 


@be1 Uncorrected error, Unrecoverable error (UEU). 
ExT, [12] 
RESO Reserved. This bit is unused. 


B1.28.2. DFSR with Long-descriptor translation table format 


DFSR has a specific format when using the Long-descriptor translation table format. 
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B1 AArch32 system registers 
B1.28 DFSR, Data Fault Status Register 


The following figure shows the DFSR bit assignments when using the Long-descriptor translation table 
format. 


When TTBCR.EAE==0: 


31 17161514131211109 8 


Fuv — L__ | PAE 
WnR 
CM 


Figure B1-25 DFSR bit assignments for Long-descriptor translation table format 


RESO 


AET, [15:14] 


Asynchronous Error Type. Describes the state of the PE after taking an asynchronous Data 
Abort exception. The value is: 





@be1 Uncorrected error, Unrecoverable error (UEV). 
ExT, [12] 
RESO Reserved. This bit is unused. 
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B1 AArch32 system registers 
B1.29 DISR, Deferred Interrupt Status Register 


B1.29  DISR, Deferred Interrupt Status Register 


DISR records that an SError interrupt has been consumed by an ESB instruction. 


Bit field descriptions 
DISR is a 32-bit register, and is part of the RAS registers group. 


There are three formats for this register. The current translation table format determines which format of 

the register is used. 

¢ When written at EL1 using Short-descriptor format. See B/.29./ DISR with Short-descriptor 
translation table format on page B1-177. 

¢ When written at EL1 using Long-descriptor format. See B/.29.2 DISR with Long-descriptor 
translation table format on page B1-178. 

¢« When written at EL2. See B/.29.3 DISR at EL2 on page B1-179. 


Configurations 


AArch32 register DISR is architecturally mapped to AArch64 register DISR_EL1. See 
B2.39 DISR_EL1, Deferred Interrupt Status Register, EL] on page B2-358. 


There is one instance of DISR that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 

¢ B1.29.1 DISR with Short-descriptor translation table format on page B1-177. 
¢ B1.29.2 DISR with Long-descriptor translation table format on page B1-178. 
¢ B1.29.3 DISR at EL2 on page B1-179. 


B1.29.1. DISR with Short-descriptor translation table format 
DISR has a specific format when written at EL1 using the Short-descriptor translation table format. 


The following figure shows the DISR bit assignments when using the Short-descriptor translation table 





format. 
When TTBCR.EAE==0: 
31 30 16151413121110 9 8 7 4 3 0 
RESO 
Figure B1-26 DISR bit assignments for Short-descriptor translation table format 
A, [31] 


Set to 1 when ESB defers an asynchronous SError interrupt. 
RESO, [30:16] 


RESO Reserved. 


AET, [15:14] 
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B1 AArch32 system registers 
B1.29 DISR, Deferred Interrupt Status Register 


Asynchronous Error Type. Describes the state of the PE after taking an asynchronous Data 
Abort exception. The value is: 


@be1 Uncorrected error, Unrecoverable error (UEU). 
RESO, [13] 

RESO Reserved. 
Ext, [12] 


External Abort Type. This bit is defined as REso. 
RESO, [11] 

RESO Reserved. 
FS[4], [10] 


Fault Status Code. See the description of DFSR.FS in the Arm® Architecture Reference Manual 
Armv8, for Armv8-A architecture profile for an SError interrupt. 


LPAE, [9] 
On taking a Data Abort exception, this bit is set as follows: 


7) Using the Short-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and 
therefore software can set this bit to 0 or | without affecting operation. 


RESO, [8:4] 
RESO Reserved. 
FS[3:0], [3:0] 


Fault Status bits. This field indicates the type of exception generated. See the description of 
DFSR.FS in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile 
for an SError interrupt. 


B1.29.2 DISR with Long-descriptor translation table format 
DISR has a specific format when written at EL1 using the Long-descriptor translation table format. 


The following figure shows the DISR bit assignments when using the Long-descriptor translation table 
format. 


When TTBCR.EAE==1: 


31 30 161514131211109 8 


ExT _l es LPAE 


RESO 


Figure B1-27 DISR bit assignments for Long-descriptor translation table format 
A, [31] 
Set to | when ESB defers an asynchronous SError interrupt. 


RESO, [30:16] 
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B1 AArch32 system registers 
B1.29 DISR, Deferred Interrupt Status Register 


RESO Reserved. 


AET, [15:14] 


Asynchronous Error Type. Describes the state of the core after taking an asynchronous Data 
Abort exception. The value is: 


@be1 Uncorrected error, Unrecoverable error (UEU). 
RESO, [13] 

RESO Reserved. 
Ext, [12] 


External Abort Type. This bit is defined as REso. 
RESO, [11:10] 
RESO Reserved. 
LPAE, [9] 
On taking a Data Abort exception, this bit is set as follows: 


1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and 
therefore software can set this bit to 0 or 1 without affecting operation. 


RESO, [8:6] 
RESO Reserved. 
Status, [5:0] 


Fault Status Code. This field indicates the type of exception generated. See the DFSR.DFSC in 
the Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile for an SError 
interrupt. 


B1.29.3 DISR at EL2 
DISR has a specific format when written at EL2. 


The following figure shows the DISR bit assignments when written at EL2: 


31 30 1211109 8 6 5 0 
L_ea 
RESO 


Figure B1-28 DISR bit assignments for Long-descriptor translation table format 
A, [31] 


Set to | when ESB defers an asynchronous SError interrupt. If the implementation does not 
include any synchronizable sources of SError interrupt, this bit is REso. 


RESO, [30:12] 


RESO Reserved. 


AET, [11:10] 
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B1 AArch32 system registers 
B1.29 DISR, Deferred Interrupt Status Register 


Asynchronous Error Type. Describes the state of the core after taking the SError interrupt 
exception. Software might use the information in the syndrome registers to determine what 
recovery might be possible. The value is: 


@be1 Uncorrected error, Unrecoverable error (UEU). 
EA, [9] 

External Abort Type. This bit is defined as REso. 
RESO, [8:6] 

RESO Reserved. 
DFSC, [5:0] 


Fault Status Code. This field indicates the type of exception generated. See the description of 


HSR.DFSC in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile 
for an SError interrupt. 
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B1 AArch32 system registers 
B1.30 ERRIDR, Error ID Register 


ERRIDR, Error ID Register 


The ERRIDR defines the number of error records that can be accessed through the Error Record system 
registers. 


Bit field descriptions 


ERRIDR is a 32-bit register, and is part of the Reliability, Availability, Serviceability (RAS) registers 
functional group. 


This register is Read Only. 


31 1615 0 


RESO 


Figure B1-29 ERRIDR bit assignments 
RESO, [31:16] 
RESO Reserved. 
NUM, [15:0] 
Number of records that can be accessed through the Error Record system registers. 


@x@ee2 Two records present. 


Configurations 


ERRIDR is architecturally mapped to AArch64 register ERRIDR_EL1. See 
B2.40 ERRIDR_ELI, Error ID Register, EL1 on page B2-360. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.31 ERRSELR, Error Record Select Register 


B1.31 ERRSELR, Error Record Select Register 


The ERRSELR selects which error record should be accessed through the Error Record system registers. 
This register is not reset on a warm reset. 


Bit field descriptions 


ERRSELR is a 32-bit register, and is part of the Reliability, Availability, Serviceability (RAS) registers 
functional group. 


63 1 0 
SEL— 
RESO 


Figure B1-30 ERRSELR bit assignments 
RESO, [31:1] 
RESO Reserved. 
SEL, [0] 
Selects the record accessed through the Error Record system registers. 


) Select record 0 containing errors from level-1 and level-2 RAMs located in the 
Cortex-A55 core. 


1 Select record | containing errors from level-3 RAMs located in the DSU. 


Configurations 


ERRSELR is architecturally mapped to AArch64 register ERRSELR_EL1. See 
B2.41 ERRSELR_ELI, Error Record Select Register, EL] on page B2-361. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.32 ERXADDR, Selected Error Record Address Register 


B1.32 ERXADDR, Selected Error Record Address Register 


The ERXADDR accesses bits [31:0] of the ERR<n>ADRR address register for the error record selected 
by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXADDR accesses the ERROADDR register of the core error record. See 
ERROADDR, Error Record Address Register. 


If ERRSELR.SEL==1, then ERXADDR accesses the ERRIADDR register of the DSU error record. See 
the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.33 ERXADDR2, Selected Error Record Address Register 2 


B1.33  ERXADDR2, Selected Error Record Address Register 2 


The ERXADDR2 accesses bits [63:32] of the ERR<n>ADRR address register for the error record 
selected by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXADDR2 accesses the ERROADDR register of the core error record. See 
B3.2 ERROADDR, Error Record Address Register on page B3-468. 


If ERRSELR.SEL==1, then ERXADDR2 accesses the ERRIADDR register of the DSU error record. 
See the Arm® DynamIO™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.34 ERXCTLR, Selected Error Record Control Register 


B1.34 ERXCTLR, Selected Error Record Control Register 


The ERXCTLR accesses bits [31:0] of the ERR<n>CTLR control register for the error record selected 
by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXCTLR accesses the ERROCTLR register of the core error record. See 
ERROCTLR, Error Record Control Register. 


If ERRSELR.SEL==1, then ERXCLTR accesses the ERRICTLR register of the DSU error record. See 
the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.35 ERXCTLR2, Selected Error Record Control Register 2 


B1.35 ERXCTLR2, Selected Error Record Control Register 2 


The ERXCTLR2 accesses bits [62:32] of the ERR<n>CTLR control register for the error record selected 
by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXCTLR2 accesses the ERROCTLR register of the core error record. See 
ERROCTLR, Error Record Control Register. 


If ERRSELR.SEL==1, then ERXCLTR2 accesses the ERR1CTLR register of the DSU error record. See 
the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.36 ERXFR, Selected Error Record Feature Register 


B1.36 ERXFR, Selected Error Record Feature Register 
Register ERXFR accesses bits [31:0] of the ERR<n>FR feature register for the error record selected by 
ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXFR accesses the ERROFR register of the core error record. See 
B3.4 ERROFR, Error Record Feature Register on page B3-471. 


If ERRSELR.SEL==1, then ERXCLTR accesses the ERR1FR register of the DSU error record. See the 
Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.37 ERXFR2, Selected Error Record Feature Register 2 


B1.37 ERXFR2, Selected Error Record Feature Register 2 


Register ERXFR2 accesses bits [63:32] of the ERR<n>FR feature register for the error record selected 
by ERRSELR.SEL. 

If ERRSELR.SEL==0, then ERXFR2 accesses the ERROFR register of the core error record. See 
B3.4 ERROFR, Error Record Feature Register on page B3-471. 


If ERRSELR.SEL==1, then ERXCLTR accesses the ERR1FR register of the DSU error record. See the 
Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.38 ERXMISCO, Selected Error Miscellaneous Register 0 


B1.38 ERXMISCO, Selected Error Miscellaneous Register 0 


Register ERXMISCO accesses bits [31:0] of the ERR<n>MISCO0 control register for the error record 
selected by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXMISCO accesses bits [31:0] of the ERROMISCO register for the core 
error record. See B3.5 ERROMISCO, Error Record Miscellaneous Register 0 on page B3-473. 


If ERRSELR.SEL==1, then ERXMISCO accesses bits [31:0] of the ERR1 MISCO register for the DSU 
error record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.39 ERXMISC1, Selected Error Miscellaneous Register 1 


B1.39 ERXMISC1, Selected Error Miscellaneous Register 1 


Register ERXMISC1 accesses bits [63:32] of the ERR<n>MISCO0 miscellaneous register 0 for the error 
record selected by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXMISC1 accesses the ERROMISC0[63:32] register of the core error 
record. See B3.5 ERROMISCO, Error Record Miscellaneous Register 0 on page B3-473. 


If ERRSELR.SEL==1, then ERXMISC1 accesses the ERR1MISCO0[63:32] register of the DSU error 
record. See the Arm® DynamIOQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.40 ERXMISC2, Selected Error Record Miscellaneous Register 2 


B1.40 ERXMISC2, Selected Error Record Miscellaneous Register 2 


Register ERXMISC2 accesses bits [31:0] of the ERR<n>MISC1 miscellaneous register | for the error 
record selected by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXMISC2 accesses the ERROMISC1[31:0] register of the core error 
record. See B3.6 ERROMISCI, Error Record Miscellaneous Register 1 on page B3-475. 


If ERRSELR.SEL==1, then ERXMISC2 accesses the ERR1 MISC1[31:0] register of the DSU error 
record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.41 ERXMISC3, Selected Error Record Miscellaneous Register 3 


B1.41 ERXMISC3, Selected Error Record Miscellaneous Register 3 


Register ERXMISC3 accesses bits [63:32] of the ERR<n>MISC1 miscellaneous register | for the error 
record selected by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXMISC3 accesses the ERROMISC1[63:32] register of the core error 
record. See B3.6 ERROMISCI, Error Record Miscellaneous Register 1 on page B3-475. 


If ERRSELR.SEL==1, then ERXMISC3 accesses the ERR1MISC1[63:32] register of the DSU error 
record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation Count Down Register 


ERXPFGCDNR, Selected Error Pseudo Fault Generation Count Down 
Register 


Register ERXPFGCDNR accesses the ERR<n>PFGCNDR register for the error record selected by 
ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXPFGCDNR accesses the ERROPFGCDNR register of the core error 
record. See B3.7 ERROPFGCDNR, Error Pseudo Fault Generation Count Down Register 
on page B3-476. 


If ERRSELR.SEL==1, then ERXPFGCDNR accesses the ERR1PFGCDNR register of the DSU error 
record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 


Configurations 


ERXPFGCDNR is architecturally mapped to AArch64 register ERXPFGCDNR_ELI. See 
B2.47 ERXPFGCDNR_ELI, Selected Error Pseudo Fault Generation Count Down Register, 
EL1 on page B2-367. 


Accessing the ERXPFGCDNR 
This register can be read using MRC with the following syntax: 
MRC <syntax> 
This register can be written using MCR with the following syntax: 
MCR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opc1 | CRn | CRm | opc2 























pl5, 0, <Rt>, cl5, c2, 2 | 1111 000 | 1111 | 0010 | 010 





Accessibility 


This register is accessible in software as follows: 

















<syntax> Control Accessibility 

E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 0, <Rt>, c15, c2, 2 x x 0 - RW n/a RW 
p15, 0, <Rt,cl5,c2,2. |x 0 1 2 RW |RW |RW 
p15, 0, <Rt,cl5,c2,2. |x 1 1 = nia |RW |RW 
































‘n/a' Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 
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B1 AArch32 system registers 
B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation Count Down Register 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. Subject to these prioritization rules, the following traps and enables are 
applicable when accessing this register. 


ERXPFGCDNR is accessible at EL3 and can be accessible at EL1 and EL2 depending on the 
value of bit[5] in ACTLR(S) and HACTLR. See B/.5 ACTLR, Auxiliary Control Register 
on page B1-133 and B/.48 HACTLR, Hyp Auxiliary Control Register on page B1-200. 


If EL2 or EL3 are in AArch64, then access to lower exception levels is controlled by 
ACTLR_EL2 or ACTLR_EL3. See B2.6 ACTLR_EL2, Auxiliary Control Register, EL2 
on page B2-305 and B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 on page B2-307. 
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B1.43 ERXPFGCTLR, Selected Error Pseudo Fault Generation Control Register 


B1 AArch32 system registers 
B1.43 ERXPFGCTLR, Selected Error Pseudo Fault Generation Control Register 


Register ERXPFGCTLR accesses bits [31:0] of the ERR<n>PFGCTLR register for the error record 


selected by ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXPFGCTLR accesses the ERROPFGCTLR register of the core error 
record. See B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control Register on page B3-477. 


If ERRSELR.SEL==1, then ERXPFGCTLR accesses the ERRIPFGCTLR register of the DSU error 
record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 


Configurations 


ERXPFGCTLR is architecturally mapped to AArch64 register ERXPFGCTLR_EL1. See 


B2.48 ERXPFGCTLR_ELI, Selected Error Pseudo Fault Generation Control Register, EL1 


on page B2-369. 
Accessing the ERXPFGCTLR 


This register can be read using MRC with the following syntax: 


MRC <syntax> 


This register can be written using MCR with the following syntax: 


MCR <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





























Accessibility 

















<syntax> coproc | opc1 | CRn | CRm | opc2 
p15, 0, <Rt>, c15, c2, 1 | 1111 000 1111 | 0010 | 001 
This register is accessible in software as follows: 
<syntax> Control Accessibility 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 0, <Rt>, c15, c2, 1 x xX 0 - RW n/a RW 
p15, 0, <Rt,cl5,c2,1 |x 0 1 : RW |RW |RW 
p15, 0, <Rt,cl5,c2,1 |x 1 1 7 nia |RW |RW 
































‘n/a' Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 
g p p 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. Subject to these prioritization rules, the following traps and enables are 


applicable when accessing this register. 


ERXPFGCTLR is accessible at EL3 and can be accessible at EL1 and EL2 depending on the 


value of bit[5] in ACTLR(S) and HACTLR. See B/.5 ACTLR, Auxiliary Control Register 


on page B1-133 and B/.48 HACTLR, Hyp Auxiliary Control Register on page B1-200. 


If EL2 or EL3 are in AArch64, then access to lower exception levels is controlled by 
ACTLR_EL2 or ACTLR_EL3. See B2.6 ACTLR_EL?2, Auxiliary Control Register, EL2 
on page B2-305 and B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 on page B2-307. 
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B1 AArch32 system registers 
B1.44 ERXPFGFR, Selected Pseudo Fault Generation Feature Register 


B1.44 ERXPFGFR, Selected Pseudo Fault Generation Feature Register 


Register ERXPFGFR accesses bits [31:0] of the ERR<n>PFGFR register for the error record selected by 
ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXPFGFR accesses the ERROPFGFR register of the core error record. See 
B3.9 ERROPFGFR, Error Pseudo Fault Generation Feature Register on page B3-479. 


If ERRSELR.SEL==1, then ERXPFGFR accesses the ERR1PFGFR register of the DSU error record. 
See the Arm® DynamIO™ Shared Unit Technical Reference Manual. 


Configurations 


ERXPFGER is architecturally mapped to AArch64 register ERXPFGFR_ELI. See 
B2.49 ERXPFGFR_EL1, Selected Pseudo Fault Generation Feature Register, EL1 
on page B2-371. 


Accessing the ERXPFGFR 
This register can be read using MRC with the following syntax: 


MRC <syntax> 


This syntax is encoded with the following settings in the instruction encoding: 





<syntax> coproc | opci1 | CRn | CRm | opc2 





pl5, 0, <Rt>, cl5, c2, 0} 1111 000 | 1111 | 0010 | 000 























Accessibility 


This register is accessible in software as follows: 

















<syntax> Control Accessibility 

E2H |TGE |NS ELO |EL1 |EL2 |EL3 
p15, 0, <Rt>, c15, c2, 0 x xX 0 - RO n/a RO 
p15, 0, <Rt>, c15, c2, 0 x 0 1 - RO RO RO 
p15, 0, <Rt,cl5,c2,0 |x 1 1 - nia |RO {RO 
































‘n/a’ Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 
Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. Subject to these prioritization rules, the following traps and enables are 
applicable when accessing this register. 
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B1 AArch32 system registers 
B1.45 ERXSTATUS, Selected Error Record Primary Status Register 


B1.45 ERXSTATUS, Selected Error Record Primary Status Register 


Register ERXSTATUS accesses the ERR<n>STATUS status register for the error record selected by 
ERRSELR.SEL. 


If ERRSELR.SEL==0, then ERXSTATUS accesses the ERROSTATUS register of the core error record. 
See B3.10 ERROSTATUS, Error Record Primary Status Register on page B3-481. 


If ERRSELR.SEL==1, then ERXSTATUS accesses the ERRISTATUS register of the DSU error record. 
See the Arm® DynamIO™ Shared Unit Technical Reference Manual. 
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B1 AArch32 system registers 
B1.46 FCSEIDR, FCSE Process ID Register 


B1.46 FCSEIDR, FCSE Process ID Register 
The FCSEIDR identifies whether the Fast Context Switch Extension (FCSE) is implemented. 


Bit field descriptions 


FCSEIDR is a 32-bit register, and is part of the Legacy feature registers functional group. 


31 0 


RAZ/WI 


Figure B1-31 FCSEIDR bit assignments 
RAZ/WI, [31:0] 
Reserved, read-as-zero/write ignore. 
Configurations 
There is one instance of this register that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.47 HACR, Hyp Auxiliary Configuration Register 


B1.47  HACR, Hyp Auxiliary Configuration Register 


HACR controls trapping to Hyp mode of IMPLEMENTATION DEFINED aspects of Non-secure EL1 or ELO 
operation. This register is not used in the Cortex-A55 core. 


Bit field descriptions 


HACR is a 32-bit register, and is part of the Virtualization registers functional group. 


31 0 


RESO 


Figure B1-32 HACR bit assignments 
RESO, [31:0] 
RESO Reserved. 
Configurations 


AArch32 System register HACR is architecturally mapped to AArch64 System register 
HACR_EL2. See B2.54 HACR_EL2, Hyp Auxiliary Configuration Register, EL2 
on page B2-376. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.48 HACTLR, Hyp Auxiliary Control Register 


B1.48 HACTLR, Hyp Auxiliary Control Register 


The HACTLR controls IMPLEMENTATION DEFINED features of Hyp mode operation. 


Bit field descriptions 

HACTLR is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Other system control registers functional group. 
¢ The Implementation defined functional group. 











31 1312111098 765 4 210 
CLUSTERPMUEN 4] 
SMEN 
TSIDEN 
PWREN 
ERXPFGEN 
ECTLREN —~4 
ACTLREN 
RESO 


Figure B1-33 HACTLR bit assignments 
RESO, [31:13] 


RESO Reserved. 
CLUSTERPMUEN, [12] 
Performance Management Registers enable. The value is: 


7) CLUSTERPM* registers are not write accessible from a lower Exception level. This is 
the reset value. 

1 CLUSTERPM* registers are write accessible from EL1 Non-secure if they are write 
accessible from EL2. 


SMEN, [11] 
Scheme Management Registers enable. The value is: 


) Registers CLUSTERTHREADSID, CLUSTERACPSID, CLUSTERSTASHSID, 
CLUSTERPARTCR, and CLUSTERBUSQOS are not write accessible from EL2. This 
is the reset value. 


1 Registers controlled by the TSIDEN bit, CLUSTERACPSID, CLUSTERSTASHSID, 
CLUSTERPARTCR, and CLUSTERBUSQOS are write accessible from EL2. 


TSIDEN, [10] 


Thread Scheme ID Register enable. The possible values are: 





) Register CLUSTERTHREADSID is not accessible from EL1 nonsecure. This is the 
reset value. 
1 Register CLUSTERTHREADSID is accessible from EL1 nonsecure if they are write 
accessible from EL2. 
RESO, [9:8] 
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B1 AArch32 system registers 
B1.48 HACTLR, Hyp Auxiliary Control Register 


RESO Reserved. 


PWREN, [7] 
Power Control Registers enable. The value is: 


7) Registers CPUPWRCTLR, CLUSTERPWRCTLR, CLUSTERPWRDN, 
CLUSTERPWRSTAT, CLUSTERL3HIT and CLUSTERL3MISS are not write 
accessible from EL1. This is the reset value. 


1 Registers CPUPWRCTLR, CLUSTERPWRCTLR, CLUSTERPWRDN, 
CLUSTERPWRSTAT, CLUSTERL3HIT and CLUSTERL3MISS are write accessible 
from EL1 Non-secure if they are write accessible from EL2. 


RESO, [6] 
RESO Reserved. 
ERXPFGEN, [5] 


Error Record Registers enable. The value is: 


) ERXPFG* are not write accessible from EL1. This is the reset value. 
1 ERXPFG* are write accessible from EL1 Non-secure if they are write accessible from 
EL2. 
RESO, [4:2] 


RESO Reserved. 


ECTLREN, [1] 


Extended Control Registers enable. The value is: 


(4) CPUECTLR and CLUSTERECTLR are not write accessible from EL1. This is the 
reset value. 
1 CPUECTLR and CLUSTERECTLR are write accessible from EL1 Non-secure if they 


are write accessible from EL2. 


ACTLREN, [0] 


Auxiliary Control Registers enable. The value is: 


(4) CPUACTLR and CLUSTERACTLR are not write accessible from EL1. This is the 
reset value. 
1 CPUACTLR and CLUSTERACTLR are write accessible from EL1 Non-secure if they 


are write accessible from EL2. 


Configurations 


The HACTLR is architecturally mapped to the AArch64 ACTLR_EL2 register. See 
B2.6 ACTLR_EL2, Auxiliary Control Register, EL2 on page B2-305. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.49 HACTLR2, Hyp Auxiliary Control Register 2 


B1.49 HACTLR2, Hyp Auxiliary Control Register 2 


The HACTLR2 Provides additional space to the HACTLR register to hold IMPLEMENTATION DEFINED trap 
functionality. 


Bit field descriptions 

HACTLR2 is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Other system control registers functional group. 
¢ The Implementation defined functional group. 


31 0 


RESO 


Figure B1-34 HACTLR2 bit assignments 
RESO, [31:0] 
RESO Reserved. 
Configurations 


The HACTLR2 is architecturally mapped to the AArch64 ACTLR_EL2[63:32] register. See 
B2.6 ACTLR_EL2, Auxiliary Control Register, EL2 on page B2-305. 


RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.50 HADFSR, Hyp Auxiliary Data Fault Status Syndrome Register 


B1.50 HADFSR, Hyp Auxiliary Data Fault Status Syndrome Register 


HADFSR provides additional IMPLEMENTATION DEFINED syndrome information for Data Abort exceptions 
taken to Hyp mode. This register is not used in the Cortex-A55 core. 


Bit field descriptions 

HADFSR is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Exception and fault handling registers functional group. 
¢ The Implementation defined functional group. 


31 0 


RESO 


Figure B1-35 HADFSR bit assignments 
RESO, [31:0] 


RESO Reserved. 


Configurations 


AArch32 System register HADFSR is architecturally mapped to AArch64 System register 
AFSRO_EL2. See B2.9 AFSRO_EL2, Auxiliary Fault Status Register 0, EL2 on page B2-310. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.51 


B1 AArch32 system registers 
B1.51 HAIFSR, Hyp Auxiliary Instruction Fault Status Syndrome Register 


HAIFSR, Hyp Auxiliary Instruction Fault Status Syndrome Register 


HAIFSR provides additional IMPLEMENTATION DEFINED syndrome information for Prefetch Abort 
exceptions taken to Hyp mode. This register is not used in the Cortex-A55 core. 


Bit field descriptions 

HAIFSR is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Exception and fault handling registers functional group. 
¢ The Implementation defined functional group. 


31 0 


P| 


RESO 
Figure B1-36 HAIFSR bit assignments 


RESO, [31:0] 
Reserved, RESO. 
Configurations 


AArch32 System register HAIFSR is architecturally mapped to AArch64 System register 
AFSR1_EL2. See B2.12 AFSRI_EL2, Auxiliary Fault Status Register 1, EL2 on page B2-313. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.52 HAMAIRO, Hyp Auxiliary Memory Attribute Indirection Register 0 


B1.52 HAMAIRO, Hyp Auxiliary Memory Attribute Indirection Register 0 


HAMAIRO provides additional IMPLEMENTATION DEFINED memory attributes for the memory attribute 
encodings defined by HMAIRO. These implementation defined attributes can only provide additional 
qualifiers for the memory attribute encodings, and cannot change the memory attributes defined in 
HMAIRO. This register is not used in the Cortex-A55 core. 


Bit field descriptions 

HAMAIRO is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Virtual memory control registers functional group. 
¢ The Implementation defined functional group. 


31 0 


P| 


RESO 


Figure B1-37 HAMAIRO bit assignments 
RESO, [31:0] 


Reserved, RESO. 


Configurations 


AArch32 System register HAMAIRO is architecturally mapped to AArch64 System register 
AMAIR_ EL2[31:0]. See B2./6 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register, 
EL2 on page B2-317. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.53 HAMAIR1, Hyp Auxiliary Memory Attribute Indirection Register 1 


B1.53 HAMAIR1, Hyp Auxiliary Memory Attribute Indirection Register 1 


HAMAIRI provides additional IMPLEMENTATION DEFINED memory attributes for the memory attribute 
encodings defined by HMAIR1. These implementation defined attributes can only provide additional 
qualifiers for the memory attribute encodings, and cannot change the memory attributes defined in 
HMAIRI. This register is not used in the Cortex-A55 core. 


Bit field descriptions 

HAMAIR1 is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Virtual memory control registers functional group. 
¢ The Implementation defined functional group. 


31 0 


po 


RESO 


Figure B1-38 HAMAIR1 bit assignments 
RESO, [31:0] 


Reserved, RESO. 


Configurations 


AArch32 System register HAMAIR1 is architecturally mapped to AArch64 System register 
AMAIR_ EL2[63:32]. See B2.16 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register, 
EL2 on page B2-317. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.54 HCR, Hyp Configuration Register 


B1.54 HCR, Hyp Configuration Register 


The HCR provides configuration controls for virtualization, including defining whether various Non- 
secure operations are trapped to Hyp mode. 


Bit field descriptions 
HCR is a 32-bit register, and is part of the Virtualization registers functional group. 


This register resets to value 0x@0000002. 
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Figure B1-39 HCR bit assignments 
RESO, [31] 


RESO Reserved. 


RESO, [29:28] 


RESO Reserved. 


TGE, [27] 
Trap General Exceptions. If this bit is set, and SCR_EL3.NS is set, then: 


All exceptions that would be routed to EL1 are routed to EL2. 

« The SCTLR.M bit is treated as 0 regardless of its actual state, other than for reading the bit. 

¢« The HCR.FMO, IMO, and AMO bits are treated as | regardless of their actual state, other 
than for reading the bits. 

¢ All virtual interrupts are disabled. 

« An exception return to EL] is treated as an illegal exception return. 


The Cortex-A55 core does not support any implementation defined mechanisms for signaling 
virtual interrupts. 


Additionally, if HCR.TGE is 1, the HDCR.{TDRA,TDOSA,TDA} bits are ignored and the core 
behaves as if they are set to 1, other than for the value read back from HDCR. 
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B1 AArch32 system registers 
B1.54 HCR, Hyp Configuration Register 


TSC, [19] 


Trap SMC instruction. When this bit is set to 1, any attempt from a Non-secure EL] state to 
execute an SMC instruction, that passes its condition check if it is conditional, is trapped to Hyp 
mode. 


SWI, [1] 
Set/Way Invalidation Override. This bit is REs1. 
Configurations 


HCR is architecturally mapped to AArch64 register HCR_EL2[31:0]. See 82.55 HCR_EL2, 
Hypervisor Configuration Register, EL2 on page B2-377. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.55 HCR2, Hyp Configuration Register 2 


HCR2, Hyp Configuration Register 2 


The HCR2 provides additional configuration controls for virtualization. 


Bit field descriptions 
HCR2 is a 32-bit register, and is part of the Virtualization registers functional group. 


This register resets to value 0x@0000000. 


31 76543210 
MIOCNCE ——! Lep 
TEA ID 
TERR 
RESO 


Figure B1-40 HCR2 bit assignments 
MIOCNCE, [6] 


Mismatched Inner/Outer Cacheable Non-Coherency Enable, for the Non-secure PL1&0 
translation regime. 


This bit is not implemented, RAZ/WI. 
Configurations 


HCR2 is architecturally mapped to AArch64 register HCR_EL2[63:32]. See 82.55 HCR_EL2, 
Hypervisor Configuration Register, EL2 on page B2-377. 


This register is accessible only at EL2 or EL3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-209 


reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.56 HSCTLR, Hyp System Control Register 


B1.56 HSCTLR, Hyp System Control Register 
The HSCTLR provides top level control of the system operation in Hyp mode. 


This register provides Hyp mode control of features controlled by the Banked SCTLR bits, and shows 
the values of the non-Banked SCTLR bits. 


Bit field descriptions 

HSCTLR is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Other system control registers functional group. 


I, [12] 


C, [2] 


M, [0] 
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Figure B1-41 HSCTLR bit assignments 


Instruction cache enable. This is an enable bit for instruction caches at EL2: 


(4) Instruction caches disabled at EL2. If HSCTLR.M is set to 0, instruction accesses from 
stage | of the EL2 translation regime are to Normal memory, Outer Shareable, Inner 
Non-cacheable, Outer Non-cacheable. This is the reset value. 


1 Instruction caches enabled at EL2. If HSCTLR.M is set to 0, instruction accesses from 
stage 1 of the EL2 translation regime are to Normal memory, Outer Shareable, Inner 
Write-Through, Outer Write-Through. 


When this bit is 0, all EL2 Normal memory instruction accesses are Non-cacheable. 


The reset value for this field is UNKNOWN. 


Cache enable. This is an enable bit for data and unified caches at EL2: 
(7) Data and unified caches disabled at EL2. This is the reset value. 
1 Data and unified caches enabled at EL2. 


When this bit is 0, all EL2 Normal memory data accesses and all accesses to the EL2 translation 
tables are Non-cacheable. 


The reset value for this field is UNKNOWN. 


MMU enable. This is a global enable bit for the EL2 stage 1 MMU: 


) EL2 stage 1 MMU disabled. This is the reset value. 
1 EL2 stage 1 MMU enabled. 


The reset value for this field is UNKNOWN. 
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B1 AArch32 system registers 
B1.56 HSCTLR, Hyp System Control Register 


Configurations 


HSCTLR is architecturally mapped to AArch64 register SCTLR_EL2. See B2.95 SCTLR_EL2, 
System Control Register, EL2 on page B2-440. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.57 HSR, Hyp Syndrome Register 


HSR, Hyp Syndrome Register 


The HSR holds syndrome information for an exception taken to Hyp mode. 


Bit field descriptions 

HSR is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Exception and fault handling registers functional group. 


31 26 25 24 0 
i IL 


Figure B1-42 HSR bit assignments 
EC, [31:26] 


Exception class. The exception class for the exception that is taken in Hyp mode. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile for more information. 


IL, [25] 


Instruction length. See the Arm® Architecture Reference Manual Armv8, for Armv8-A 
architecture profile for more information. 


ISS, [24:0] 


Instruction specific syndrome. See the Arm® Architecture Reference Manual Armv8, for Armv8- 
A architecture profile for more information. The interpretation of this field depends on the value 
of the EC field. See B/.57.1 Encoding of ISS[24:20] when HSR[31:30] is 0b00 on page B1-212. 


Configurations 


HSR is architecturally mapped to AArch64 register ESR_EL2. See B2.52 ESR_EL2, Exception 
Syndrome Register, EL2 on page B2-374. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsection: 
¢ B1.57.1 Encoding of ISS[24:20] when HSR[31:30] is 0b00 on page B1-212. 


Encoding of ISS[24:20] when HSR[31:30] is 0b00 


For EC values that are non-zero and have the two most-significant bits 0b00, ISS[24:20] provides the 
condition field for the trapped instruction, together with a valid flag for this field. 


The encoding of this part of the ISS field is: 


CV, ISS[24] 
Condition valid. Possible values of this bit are: 
@ The COND field is not valid. 
1 The COND field is valid. 


When an instruction is trapped, CV is set to 1. 

COND, ISS[23:20] 
The Condition field for the trapped instruction. This field is valid only when CV is set to 1. 
If CV is set to 0, this field is REso. 
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B1 AArch32 system registers 
B1.57 HSR, Hyp Syndrome Register 


When an instruction is trapped, the COND field is set to the condition the instruction was executed with. 


When reporting an SEI, the following occurs: 

¢ AET always reports an uncontainable error (UC) with value @bee. 
¢ EA is RESO. 

¢ DFSC is always at 0b010001. 


When reporting a synchronous external data abort, EA is RESO. 


When reporting a synchronous external prefetch abort, EA is RESo. 
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B1 AArch32 system registers 
B1.58 HTTBR, Hyp Translation Table Base Register 


B1.58 HTTBR, Hyp Translation Table Base Register 


The HTTBR holds the base address of the translation table for the stage | translation of memory accesses 
from Hyp mode. 


Bit field descriptions 
HTTBR is a 64-bit register. 





63 48 47 10 
BADDR | 
CnP— 
RESO 


Figure B1-43 HTTBR bit assignments 


CnP, [0] 
Common not Private. The possible values are: 
0 CnP is not supported. 
1 CnP is supported. 
Configurations 


AArch32 System register HTTBR is architecturally mapped to AArch64 System register 
TTBRO_EL2. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.59 ID_AFRO, Auxiliary Feature Register 0 


B1.59 ID_AFRO, Auxiliary Feature Register 0 


The ID_AFRO provides information about the IMPLEMENTATION DEFINED features of the PE in AArch32. 
This register is not used in the Cortex-A55 core. 


Bit field descriptions 


ID_AFR0 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 0 
RESO 
Figure B1-44 ID_AFRO bit assignments 
RESO, [31:0] 
Reserved, RESO. 
Configurations 


AArch32 System register ID_AFRO is architecturally mapped to AArch64 System register 
ID_AFRO ELI. See B2.65 ID_AFRO_EL1, AArch32 Auxiliary Feature Register 0, EL1 
on page B2-393. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.60 


B1 AArch32 system registers 
B1.60 ID_DFRO, Debug Feature Register 0 


ID_DFRO, Debug Feature Register 0 


The ID_DFRO provides top-level information about the debug system in AArch32. 


Bit field descriptions 
ID_DFR0 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


RESO 


Figure B1-45 ID_DFRO bit assignments 
RESO, [31:28] 
RESO Reserved. 
PerfMon, [27:24] 
Indicates support for performance monitor model: 


ex4 Support for Performance Monitor Unit version 3 (PMUv3) system registers, with a 
16-bit evtCount field. 


MProfDbg, [23:20] 
Indicates support for memory-mapped debug model for M profile cores: 
@xe This product does not support M profile Debug architecture. 
MMapTre, [19:16] 
Indicates support for memory-mapped trace model: 
@x1 Support for Arm trace architecture, with memory-mapped access. 
In the Trace registers, the ETMIDR gives more information about the implementation. 
CopTre, [15:12] 
Indicates support for coprocessor-based trace model: 
exe This product does not support Arm trace architecture. 
RESO, [11:8] 
RESO Reserved. 
CopSDbg, [7:4] 
Indicates support for coprocessor-based Secure debug model: 
@x8 This product supports v8.2 Debug architecture. 
CopDbg, [3:0] 
Indicates support for coprocessor-based debug model: 


@x8 This product supports v8.2 Debug architecture. 
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B1 AArch32 system registers 
B1.60 ID_DFRO, Debug Feature Register 0 


Configurations 


ID_DFR0O is architecturally mapped to AArch64 register ID DFRO_EL1. See 
B2.66 ID_DFRO_EL1, AArch32 Debug Feature Register 0, EL1 on page B2-394. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.61 ID_ISARO, Instruction Set Attribute Register 0 








B1.61 ID_ISARO, Instruction Set Attribute Register 0 
The ID_ISARO provides information about the instruction sets implemented by the core in AArch32. 
Bit field descriptions 
ID_ISARO is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 
31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 
RESO 
Figure B1-46 ID_ISARO bit assignments 
RESO, [31:28] 
RESO Reserved. 
Divide, [27:24] 
Indicates the implemented Divide instructions: 
@x2 ¢ SDIV and UDIV in the T32 instruction set. 
* SDIV and UDIV in the A32 instruction set. 
Debug, [23:20] 
Indicates the implemented Debug instructions: 
6x1 BKPT. 
Coproc, [19:16] 
Indicates the implemented Coprocessor instructions: 
exe None implemented, except for instructions separately attributed by the architecture to 
provide access to AArch32 System registers and System instructions. 
CmpBranch, [15:12] 
Indicates the implemented combined Compare and Branch instructions in the T32 instruction 
set: 
6x1 CBNZ and CBZ. 
Bitfield, [11:8] 
Indicates the implemented bit field instructions: 
ex1 BFC, BFI, SBFX, and UBFX. 
BitCount, [7:4] 
Indicates the implemented Bit Counting instructions: 
6x1 CLZ. 
Swap, [3:0] 
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B1 AArch32 system registers 
B1.61 ID_ISARO, Instruction Set Attribute Register 0 


Indicates the implemented Swap instructions in the A32 instruction set: 


@xe None implemented. 


Configurations 


ID_ISARO is architecturally mapped to AArch64 register ID ISARO ELI. See 
B2.67 ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, ELI on page B2-396. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID ISAR1, ID ISAR2, ID _ISAR3, ID_ISAR4, and ID_ISARS. See: 
¢ B1.62 ID_ISARI, Instruction Set Attribute Register 1 on page B1-220. 
¢ B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222. 
¢ B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224. 
¢ B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226. 
¢ B1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.62 


B1 AArch32 system registers 
B1.62 ID_ISAR1, Instruction Set Attribute Register 1 


ID_ISAR1, Instruction Set Attribute Register 1 


The ID_ISARI1 provides information about the instruction sets implemented by the core in AArch32. 


Bit field descriptions 
ID_ISAR1 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


Figure B1-47 ID_ISAR1 bit assignments 
Jazelle, [31:28] 
Indicates the implemented Jazelle Extension instructions: 


@x1 The BX3 instruction, and the J bit in the PSR. 


Interwork, [27:24] 
Indicates the implemented Interworking instructions: 


@x3 ¢ The BX instruction, and the T bit in the PSR. 
¢ The BLX instruction. PC loads have Bx-like behavior. 
¢ Data-processing instructions in the A32 instruction set with the PC as the 
destination and the S bit clear have Bx-like behavior. 
Immediate, [23:20] 


Indicates the implemented data-processing instructions with long immediates: 


@x1 ¢ The MOVT instruction. 
¢ The MOV instruction encodings with zero-extended 16-bit immediates. 
¢ The T32 ADD and SUB instruction encodings with zero-extended 12-bit immediates, 
and other ADD, ADR, and SUB encodings cross-referenced by the pseudocode for 
those encodings. 
IfThen, [19:16] 


Indicates the implemented If-Then instructions in the T32 instruction set: 

@x1 The IT instructions, and the IT bits in the PSRs. 
Extend, [15:12] 

Indicates the implemented Extend instructions: 

@x2 ¢ The SXTB, SXTH, UXTB, and UXTH instructions. 

¢ The SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, UXTAB16, and UXTAH 
instructions. 

Except_AR, [11:8] 

Indicates the implemented A profile exception-handling instructions: 

ex1 The SRS and RFE instructions, and the A and R profile forms of the CPS instruction. 
Except, [7:4] 


Indicates the implemented exception-handling instructions in the A32 instruction set: 
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B1 AArch32 system registers 
B1.62 ID_ISAR1, Instruction Set Attribute Register 1 


@x1 The LDM (exception return), LDM (user registers), and STM (user registers) instruction 
versions. 
Endian, [3:0] 
Indicates the implemented Endian instructions: 


@x1 The SETEND instruction, and the E bit in the PSRs. 


Configurations 


ID_ISAR1 is architecturally mapped to AArch64 register ID ISARI_EL1. See 
B2.68 ID_ISARI_EL1, AArch32 Instruction Set Attribute Register 1, ELI on page B2-398. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID_ISARO, ID_ISAR2, ID_ISAR3, ID_ISAR4 and ID_ISARS. See: 
¢ B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218. 
¢ B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222. 
¢ B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224. 
¢ B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226. 
¢ B1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.63 ID_ISAR2, Instruction Set Attribute Register 2 


B1.63 ID_ISAR2, Instruction Set Attribute Register 2 
The ID_ISAR2 provides information about the instruction sets implemented by the core in AArch32. 


Bit field descriptions 
ID_ISAR2 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


MultiAccessInt — 
Figure B1-48 ID_ISAR2 bit assignments 
Reversal, [31:28] 


Indicates the implemented Reversal instructions: 


@x2 ¢ The REV, REV16, and REVSH instructions. 
¢ The RBIT instruction. 


PSR_AR, [27:24] 
Indicates the implemented A and R profile instructions to manipulate the PSR: 


ex1 The MRS and MSR instructions, and the exception return forms of data-processing 
instructions. 


The exception return forms of the data-processing instructions are: 

¢ Inthe A32 instruction set, data-processing instructions with the PC as the destination and the 
S bit set. 

¢ Inthe T32 instruction set, the SUBS PC, LR, #N instruction. 


MultU, [23:20] 
Indicates the implemented advanced unsigned Multiply instructions: 


@x2 ¢ The UMULL and UMLAL instructions. 
¢ The UMAAL instruction. 


Mult, [19:16] 
Indicates the implemented advanced signed Multiply instructions. 


@x3 ¢ The SMULL and SMLAL instructions. 
¢ The SMLABB, SMLABT, SMLALBB, SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, 
SMLAWB, SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT instructions, 
and the Q bit in the PSRs. 
* The SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, 
SMMLAR, SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDX 
instructions. 


Mult, [15:12] 


Indicates the implemented additional Multiply instructions: 


@x2 ¢ The MUL instruction. 
¢ The MLA instruction. 
¢ The MLS instruction. 
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B1 AArch32 system registers 
B1.63 ID_ISAR2, Instruction Set Attribute Register 2 


MultiAccessInt, [11:8] 

Indicates the support for interruptible multi-access instructions: 

exe No support. This means that the LDM and STM instructions are not interruptible. 
MemHint, [7:4] 

Indicates the implemented memory hint instructions: 


@x4 ¢ The PLD instruction. 
¢ The PLI instruction. 
¢ The PLDW instruction. 


LoadStore, [3:0] 
Indicates the implemented additional load/store instructions: 


@x2 ¢ The LDRD and STRD instructions. 
* The Load Acquire (LDAB, LDAH, LDA, LDAEXB, LDAEXH, LDAEX, and LDAEXD) and 
Store Release (STLB, STLH, STL, STLEXB, STLEXH, STLEX, and STLEXD) instructions. 


Configurations 


ID_ISAR2 is architecturally mapped to AArch64 register ID ISAR2_ EL1. See 
B2.69 ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 2, ELI on page B2-400. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID ISARO, ID ISAR1, ID_ISAR3, ID_ISAR4 and ID_ISARS. See: 
¢ B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218. 
¢ B1.62 ID_ISARI, Instruction Set Attribute Register 1 on page B1-220. 
¢ B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224. 
¢ B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226. 
¢ B1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.64 ID_ISAR3, Instruction Set Attribute Register 3 
The ID_ISAR3 provides information about the instruction sets implemented by the core in AArch32. 
Bit field descriptions 
ID_ISAR3 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 
28 27 24 23 20 19 16 15 12 11 
ii 
Figure B1-49 ID_ISAR3 bit assignments 
T32EE, [31:28] 
Indicates the implemented Thumb Execution Environment (T32EE) instructions: 
exe None implemented. 
TrueNOP, [27:24] 
Indicates the implemented true NOP instructions: 
ex1 True NOP instructions in both the A32 and T32 instruction sets, and additional NOP- 
compatible hints. 
T32Copy, [23:20] 
Indicates the support for T32 non flag-setting MOV instructions: 
@x1 Support for T32 instruction set encoding T1 of the MOV (register) instruction, copying 
from a low register to a low register. 
TabBranch, [19:16] 
Indicates the implemented Table Branch instructions in the T32 instruction set. 
@x1 The TBB and TBH instructions. 
SynchPrim, [15:12] 
Used in conjunction with ID_ISAR4.SynchPrim_frac to indicate the implemented 
Synchronization Primitive instructions. 
@x2 ¢ The LDREX and STREX instructions. 
¢ The CLREX, LDREXB, STREXB, and STREXH instructions. 
¢ The LDREXD and STREXD instructions. 
SVC, [11:8] 
Indicates the implemented SVC instructions: 
ex1 The SVC instruction. 
SIMD, [7:4] 
Indicates the implemented Single Instruction Multiple Data (SIMD) instructions. 
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@x3 ¢ The SSAT and USAT instructions, and the Q bit in the PSRs. 
* The PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, QSUB8, QSAX, SADD16, SADD8, 
SASX, SEL, SHADD16, SHADD8, SHASX, SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, 
SSUB8, SSAX, SXTAB16, SXTB16, UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, 
UHSUB16, UHSUB8, UHSAX, UQADD16, UQADD8, UQASX, UQSUB16, UQSUB8, UQSAX, 
USAD8, USADA8, USAT16, USUB16, USUB8, USAX, UXTAB16, UXTB16 instructions, and 
the GE[3:0] bits in the PSRs. 


The SIMD field relates only to implemented instructions that perform SIMD 
operations on the general-purpose registers. In an implementation that supports 
Advanced SIMD and floating-point instructions, MVFRO, MVFRI1, and MVFR2 give 
information about the implemented Advanced SIMD instructions. 


Saturate, [3:0] 
Indicates the implemented Saturate instructions: 


ex1 The QADD, QDADD, QDSUB, QSUB and the Q bit in the PSRs. 


Configurations 


ID_ISAR3 is architecturally mapped to AArch64 register ID ISAR3_EL1. See 
B2.70 ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, ELI on page B2-402. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID ISARO, ID ISAR1, ID ISAR2, ID_ISAR4, and ID_ISARS. See: 
¢ B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218. 
¢ B1.62ID_ISARI, Instruction Set Attribute Register 1 on page B1-220. 
¢ B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222. 
¢ B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226. 
¢ B1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.65 ID_ISAR4, Instruction Set Attribute Register 4 








B1.65 ID_ISAR4, Instruction Set Attribute Register 4 
The ID_ISAR4 provides information about the instruction sets implemented by the core in AArch32. 
Bit field descriptions 
ID_ISAR4 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 
31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 
SynchPrim_frac — 
Figure B1-50 ID_ISAR4 bit assignments 
SWP_frac, [31:28] 
Indicates support for the memory system locking the bus for SWP or SWPB instructions: 
exe SWP and SWPB instructions not implemented. 
PSR_M, [27:24] 
Indicates the implemented M profile instructions to modify the PSRs: 
exe None implemented. 
SynchPrim_frac, [23:20] 
This field is used with the ID_ISAR3.SynchPrim field to indicate the implemented 
Synchronization Primitive instructions: 
exe ¢ The LDREX and STREX instructions. 
¢ The CLREX, LDREXB, LDREXH, STREXB, and STREXH instructions. 
¢ The LDREXD and STREXD instructions. 
Barrier, [19:16] 
Indicates the supported Barrier instructions in the A32 and T32 instruction sets: 
@x1 The DMB, DSB, and ISB barrier instructions. 
SMC, [15:12] 
Indicates the implemented SMC instructions: 
ex1 The SMC instruction. 
Write-Back, [11:8] 
Indicates the support for Write-Back addressing modes: 
ex1 Core supports all the Write-Back addressing modes defined in Armv8-A. 
WithShifts, [7:4] 
Indicates the support for instructions with shifts: 
ex4 ¢ Support for shifts of loads and stores over the range LSL 0-3. 
¢ Support for other constant shift options, both on load/store and other instructions. 
¢ Support for register-controlled shift options. 
Unpriv, [3:0] 
100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-226 


reserved. 
Non-Confidential 
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Indicates the implemented unprivileged instructions: 


@x2 ¢ The LDRBT, LDRT, STRBT, and STRT instructions. 
¢ The LDRHT, LDRSBT, LDRSHT, and STRHT instructions. 


Configurations 


ID_ISAR4 is architecturally mapped to AArch64 register ID ISAR4 ELI. See 
B2.71 ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4, ELI on page B2-404. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID_ISARO, ID_ISAR1, ID_ISAR2, ID_ISAR3, and ID_ISARS. See: 
¢ B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218. 
¢ B1.62 ID_ISARI, Instruction Set Attribute Register 1 on page B1-220. 
¢ B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222. 
¢ B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224. 
¢ B1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.66 ID_ISARS, Instruction Set Attribute Register 5 


The ID_ISARS provides information about the instruction sets that the core implements. 


Bit field descriptions 
ID_ISARS is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 16 15 12 11 


RESO 


Figure B1-51 ID_ISARS5 bit assignments 

RESO, [31:28] 

RESO Reserved. 
RDM, [27:24] 

VQRDMLAH and VQRDMLSH instructions in AArch32. The value is: 

@x1 VQRDMLAH and VQRDMLSH instructions are implemented. 
RESO, [23:20] 

RESO Reserved. 
CRC32, [19:16] 

Indicates whether CRC32 instructions are implemented in AArch32 state. The value is: 


@x1 CRC32B, CRC32H, CRC32W, CRC32CB, CRC32CH, and CRC32CW instructions 
are implemented. 


SHA2, [15:12] 
Indicates whether SHA2 instructions are implemented in AArch32 state: 


@x® No SHA2 instructions implemented. This is the value when the Cryptographic 
Extensions are not implemented or are disabled. 


@x1 SHA256H, SHA256H2, SHA256SU@, and SHA256SU1 implemented. This is the value when 
the Cryptographic Extensions are implemented and enabled. 


SHA1, [11:8] 
Indicates whether SHA1 instructions are implemented in AArch32 state. Defined values are: 


@x® No SHA1 instructions implemented. This is the value when the Cryptographic 
Extensions are not implemented or are disabled. 


@x1 SHA1C, SHA1P, SHA1M, SHA1H, SHA1SU@, and SHA1SU1 implemented. This is the value 
when the Cryptographic Extensions are implemented and enabled. 


AES, [7:4] 


Indicates whether AES instructions are implemented in AArch32 state. Defined values are: 
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@x® No AES instructions implemented. This is the value when the Cryptographic 
Extensions are not implemented or are disabled. 


@x2 « AESE, AESD, AESMC, and AESIMC implemented. 
¢ PMULL/PMULL2 instructions operating on 64-bit data quantities. 


This is the value when the Cryptographic Extensions are implemented and enabled. 


SEVL, [3:0] 
Indicates whether the SEVL instruction is implemented in AArch32. The value is: 


ex1 SEVL is implemented as send event local. 


Configurations 


ID_ISARS is architecturally mapped to AArch64 register ID ISARS_EL1. See 
B2.72 ID_ISAR5_EL1, AArch32 Instruction Set Attribute Register 5, ELI on page B2-406. 


There is one copy of this register that is used in both Secure and Non-secure states. 


ID_ISARS must be interpreted with ID_ISARO, ID_ISAR1, ID_ISAR2, ID_ISAR3, and ID_ISAR4. See: 
¢ B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218. 
¢ B1.62 ID_ISARI, Instruction Set Attribute Register 1 on page B1-220. 
¢ B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222. 
¢ B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224. 
¢ B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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ID_ISAR6, Instruction Set Attribute Register 6 


The ID_ISAR6 provides information about the instruction sets that the core implements. 


Bit field descriptions 
ID_ISAR6 is a 32-bit register, and is part of the Identification registers functional group. 


This register is Read Only. 


31 8 7 4 3 0 


RESO 


Figure B1-52 ID_ISAR6 bit assignments 
RESO, [31:8] 


RESO Reserved. 
DP, [7:4] 
UDOT and SDOT instructions. The value is: 


@beee1 UDOT and SDOT instructions are implemented. 


RESO, [3:0] 


RESO Reserved. 


Configurations 


ID_ISAR6 is architecturally mapped to AArch64 register ID ISAR6_EL1. See 
B2.73 ID ISAR6_EL1, AArch32 Instruction Set Attribute Register 6, EL] on page B2-408. 


There is one copy of this register that is used in both Secure and Non-secure states. 


ID_ISAR6 must be interpreted with ID_ISARO, ID_ISARI, ID ISAR2, ID_ISAR3, ID_ISAR4, and 
ID_ISARS. See: 

¢ B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218. 

¢ B1.62ID_ISARI, Instruction Set Attribute Register 1 on page B1-220. 

¢ B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222. 

¢ B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224. 

¢ B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226. 

¢ BI1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.68 ID_MMFRO, Memory Model Feature Register 0 


ID_MMFRO, Memory Model Feature Register 0 


The ID MMEFR0O provides information about the memory model and memory management support in 
AArch32. 


Bit field descriptions 
ID_MMER0O is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


Fos jason | Tom | sharelwi | outershr | eMsa | VMSA 


Figure B1-53 ID_MMFR0O bit assignments 

InnerShr, [31:28] 

Indicates the innermost shareability domain implemented: 

@x1 Implemented with hardware coherency support. 
FCSE, [27:24] 

Indicates support for Fast Context Switch Extension (FCSE): 

exe Not supported. 
AuxReg, [23:20] 

Indicates support for Auxiliary registers: 


@x2 Support for Auxiliary Fault Status Registers (AIFSR and ADFSR) and Auxiliary 
Control Register. 


TCM, [19:16] 
Indicates support for TCMs and associated DMAs: 
exe Not supported. 
ShareLvl, [15:12] 
Indicates the number of shareability levels implemented: 
@x1 Two levels of shareability implemented. 
OuterShr, [11:8] 
Indicates the outermost shareability domain implemented: 
@x1 Implemented with hardware coherency support. 
PMSA, [7:4] 
Indicates support for a Protected Memory System Architecture (PMSA): 
exe Not supported. 
VMSA, [3:0] 
Indicates support for a Virtual Memory System Architecture (VMSA). 
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@x5 Support for: 
« VMSAv7, with support for remapping and the Access flag. 
¢ The PXN bit in the Short-descriptor translation table format descriptors. 
¢ The Long-descriptor translation table format. 


Configurations 


ID_MMER0O is architecturally mapped to AArch64 register ID MMFRO_ELI. See 
B2.74 ID_MMFRO_EL1, AArch32 Memory Model Feature Register 0, EL] on page B2-409. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID MMFRI1, ID MMFR2, ID _MMER3, and ID_ MMFR4. See: 
¢ B1.69 ID_MMFRI1, Memory Model Feature Register I on page B1-233. 
¢ B1.70 ID_MMFR2, Memory Model Feature Register 2 on page B1-235. 
¢ B1.71 ID_MMFR3, Memory Model Feature Register 3 on page B1-237. 
¢ B1.72 ID_MMFR4, Memory Model Feature Register 4 on page B1-239. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.69 ID _MMFR1, Memory Model Feature Register 1 


The ID MMFRI provides information about the memory model and memory management support in 
AArch32. 


Bit field descriptions 
ID_MMER1 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 2423 20 19 1615 12 11 


L1TstCin L1Hvd L1UniSW | L1HvdSW | L1UniVA | L1HvdVA 


Figure B1-54 ID_MMFR1 bit assignments 
BPred, [31:28] 
Indicates branch predictor management requirements: 


x4 For execution correctness, branch predictor requires no flushing at any time. 


L1TstCln, [27:24] 


Indicates the supported L1 Data cache test and clean operations, for Harvard or unified cache 
implementation: 


exe None supported. 


L1Uni, [23:20] 


Indicates the supported entire L1 cache maintenance operations, for a unified cache 
implementation: 


exe None supported. 


L1Hvd, [19:16] 


Indicates the supported entire L1 cache maintenance operations, for a Harvard cache 
implementation: 


exe None supported. 


L1UniSW, [15:12] 


Indicates the supported L1 cache line maintenance operations by set/way, for a unified cache 
implementation: 


@xe None supported. 


L1HvdSW, [11:8] 


Indicates the supported L1 cache line maintenance operations by set/way, for a Harvard cache 
implementation: 


@xe None supported. 
L1UniVA, [7:4] 


Indicates the supported L1 cache line maintenance operations by VA, for a unified cache 
implementation: 


exe None supported. 


LiHvdVA, [3:0] 
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B1 AArch32 system registers 
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Indicates the supported L1 cache line maintenance operations by VA, for a Harvard cache 
implementation: 


exe None supported. 


Configurations 


ID_MMER1 is architecturally mapped to AArch64 register ID MMFR1_ ELI. See 
B2.75 ID_MMFR1_EL1, AArch32 Memory Model Feature Register 1, EL1 on page B2-411. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID. MMFRO, ID MMFR2, ID _MMER3, and ID_ MMFR4. See: 
¢« B1.68 ID_MMFRO, Memory Model Feature Register 0 on page B1-231. 
¢ B1.70 ID_MMFR2, Memory Model Feature Register 2 on page B1-235. 
¢ B1.71 ID_MMFR3, Memory Model Feature Register 3 on page B1-237. 
¢ B1.72 ID_MMFR4, Memory Model Feature Register 4 on page B1-239. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.70 ID_MMFR2, Memory Model Feature Register 2 


ID_MMFR2, Memory Model Feature Register 2 


The ID_ MMEFR2 provides information about the implemented memory model and memory management 
support in AArch32. 


Bit field descriptions 
ID_MMER2 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


HWAccFlg | WFIStall UniTLB HvdTLB |LL1HvdRng| L1HvdBG | L1HvdFG 


Figure B1-55 ID_MMFR2 bit assignments 
HWaAccFig, [31:28] 


Hardware Access Flag. Indicates support for a Hardware Access flag, as part of the VMSAv7 
implementation: 


exe Not supported. 


WFIStall, [27:24] 
Wait For Interrupt Stall. Indicates the support for Wait For Interrupt (WFI) stalling: 
ex1 Support for WFI stalling. 


MemBarr, [23:20] 
Memory Barrier. Indicates the supported CP15 memory barrier operations. 


@x2 Supported CP15 memory barrier operations are: 
¢ Data Synchronization Barrier (DSB). 
¢ Instruction Synchronization Barrier (ISB). 
¢ Data Memory Barrier (DMB). 


UniTLB, [19:16] 


Unified TLB. Indicates the supported TLB maintenance operations, for a unified TLB 
implementation. 


@x6 Supported unified TLB maintenance operations are: 
¢ Invalidate all entries in the TLB. 
¢ Invalidate TLB entry by VA. 
¢ Invalidate TLB entries by ASID match. 
¢ Invalidate instruction TLB and data TLB entries by VA All ASID. This is a shared 
unified TLB operation. 
¢ Invalidate Hyp mode unified TLB entry by VA. 
¢ Invalidate entire Non-secure PL1 and PLO unified TLB. 
¢ Invalidate entire Hyp mode unified TLB. 
¢* TLBIMVALIS, TLBIMVAALIS, TLBIMVALHIS, TLBIMVAL, TLBIMVAAL, and TLBIMVALH. 
¢ TLBIIPAS2IS, TLBIIPAS2LIS, TLBIIPAS2, and TLBIIPAS2L. 


HvdTLB, [15:12] 


Harvard TLB. Indicates the supported TLB maintenance operations, for a Harvard TLB 
implementation: 


exe Not supported. 
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LL1HvdRng, [11:8] 


LI Harvard cache Range. Indicates the supported L1 cache maintenance range operations, for a 
Harvard cache implementation: 


@xe Not supported. 


LiHvdBG, [7:4] 


L1 Harvard cache Background fetch. Indicates the supported L1 cache background prefetch 
operations, for a Harvard cache implementation: 


@xe Not supported. 


L1HvdFG, [3:0] 


L1 Harvard cache Foreground fetch. Indicates the supported L1 cache foreground prefetch 
operations, for a Harvard cache implementation: 


@xe Not supported. 


Configurations 


ID_MMER2 is architecturally mapped to AArch64 register ID MMFR2_ ELI. See 
B2.76 ID_MMFR2_EL1, AArch32 Memory Model Feature Register 2, EL] on page B2-413. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID MMFRO, ID MMFRI1, ID _MMFR3, and ID MMFR4. See: 
¢ B1.68 ID _MMFRO, Memory Model Feature Register 0 on page B1-231. 
¢ B1.69 ID_MMFRI, Memory Model Feature Register I on page B1-233. 
¢ B1.71 ID_MMFR3, Memory Model Feature Register 3 on page B1-237. 
¢ B1.72 ID_MMFR4, Memory Model Feature Register 4 on page B1-239. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.71 ID_MMFR3, Memory Model Feature Register 3 


The ID MMEFR3 provides information about the memory model and memory management support in 
AArch32. 


Bit field descriptions 
ID_MMER3 is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 





Figure B1-56 ID_MMFR3 bit assignments 

Supersec, [31:28] 

Supersections. Indicates support for supersections: 

exe Supersections supported. 
CMemSz, [27:24] 

Cached Memory Size. Indicates the size of physical memory supported by the core caches: 

@x2 1TByte, corresponding to a 40-bit physical address range. 
CohWalk, [23:20] 


Coherent walk. Indicates whether translation table updates require a clean to the point of 
unification: 


ex1 Updates to the translation tables do not require a clean to the point of unification to 
ensure visibility by subsequent translation table walks. 


PAN, [19:16] 


Privileged Access Never. Indicates support for the PAN bit in CPSR, SPSR, and DSPSR in 
AArch32. 


@x2 ¢ PAN supported. 
¢ ATSICPRP and ATSICPWP supported. 
MaintBest, [15:12] 


Maintenance broadcast. Indicates whether cache, TLB, and branch predictor operations are 
broadcast: 


@x2 Cache, TLB, and branch predictor operations affect structures according to 
shareability and defined behavior of instructions. 


BPMaint, [11:8] 


Branch predictor maintenance. Indicates the supported branch predictor maintenance operations. 


@x2 Supported branch predictor maintenance operations are: 
¢ Invalidate all branch predictors. 
¢ Invalidate branch predictors by Virtual Address (VA). 


CMaintSW, [7:4] 
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Cache maintenance by set/way. Indicates the supported cache maintenance operations by set/ 
way. 
ex1 Supported hierarchical cache maintenance operations by set/way are: 

¢ Invalidate data cache by set/way. 


¢ Clean data cache by set/way. 
¢ Clean and invalidate data cache by set/way. 


CMaintVA, [3:0] 
Cache maintenance by VA. Indicates the supported cache maintenance operations by VA. 


@x1 Supported hierarchical cache maintenance operations by VA are: 
¢ Invalidate data cache by VA. 
* Clean data cache by VA. 
¢ Clean and invalidate data cache by VA. 
¢ Invalidate instruction cache by VA. 
¢ Invalidate all instruction cache entries. 


Configurations 


ID_MMER3 is architecturally mapped to AArch64 register ID MMFR3_ ELI. See 
B2.77 ID_MMFR3_EL1, AArch32 Memory Model Feature Register 3, EL1 on page B2-415. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID MMFRO, ID MMFRI1, ID MMFR2, and ID MMFR4. See: 
¢ B1.68 ID_MMFRO, Memory Model Feature Register 0 on page B1-231. 
¢ B1.69ID_MMFRI1, Memory Model Feature Register 1 on page B1-233. 
¢ B1.70 ID_MMFR2, Memory Model Feature Register 2 on page B1-235. 
¢ B1.72 ID_MMFR4, Memory Model Feature Register 4 on page B1-239. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.72 ID_MMFR4, Memory Model Feature Register 4 


B1.72 ID _MMFR4, Memory Model Feature Register 4 


The ID_MMFR4 provides information about the memory model and memory management support in 
AArch32. 

Bit field descriptions 

ID_MMFR4 is a 32-bit register, and is part of the Identification registers functional group. 

This register is Read Only. 


31 24 23 20 19 1615 12 11 8 7 4 3 0 


Figure B1-57 ID_MMFR4 bit assignments 
RAZ, [31:24] 


Read-as-zero. 


LSM, [23:20] 
Load/Store Multiple. Indicates whether adjacent loads or stores can be combined. The value is: 


exe LSMAOE and nTLSMD bit not supported. 


HD, [19:16] 
Hierarchical Disables. Enables an operating system or hypervisor to hand over up to 4 bits of the 
last level page table descriptor (bits[62:59] of the page table entry) for use by hardware for 
IMPLEMENTATION DEFINED usage. The value is: 


@x2 Hierarchical Permission Disables and Hardware allocation of bits[62:59] supported. 


CNP, [15:12] 
Common Not Private. Indicates support for selective sharing of TLB entries across multiple 
cores. The value is: 


@x1 CnP bit supported. 


XNX, [11:8] 
Execute Never. Indicates whether the stage 2 translation tables allows the stage 2 control of 
whether memory is executable at EL1 independent of whether memory is executable at ELO. 
The value is: 


@x1 EL0/EL1 execute control distinction at stage2 bit supported. 
AC2, [7:4] 


Indicates the extension of the ACTLR and HACTLR registers using ACTLR2 and HACTLR2. 
The value is: 


@x1 ACTLR2 and HACTLR2 are implemented. 
SpecSEI], [3:0] 


Describes whether the core can generate SError interrupt exceptions from speculative reads of 
memory, including speculative instruction fetches. The value is: 





exe The core never generates an SError interrupt due to an external abort on a speculative 
read. 
100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-239 
reserved. 


Non-Confidential 


B1 AArch32 system registers 
B1.72 ID_MMFR4, Memory Model Feature Register 4 


Configurations 


ID_MMFR4 is architecturally mapped to AArch64 register ID MMFR4 ELI. See 
B2.78 ID_MMFR4_EL1, AArch32 Memory Model Feature Register 4, EL1 on page B2-417. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID. MMFRO, ID MMFRI1, ID MMER2, and ID_MMER3. See: 
¢« B1.68 ID_MMFRO, Memory Model Feature Register 0 on page B1-231. 
¢ B1.69ID_MMFRI, Memory Model Feature Register I on page B1-233. 
¢ B1.70 ID_MMFR2, Memory Model Feature Register 2 on page B1-235. 
¢ B1.71 ID_MMFR3, Memory Model Feature Register 3 on page B1-237. 


Bit fields and details not provided in this description are architecturally defined. See the Arm" 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.73 ID_PFRO, Processor Feature Register 0 


B1.73 ID _PFRO, Processor Feature Register 0 


The ID_PFRO provides top-level information about the instruction sets supported by the core in 
AArch32. 


Bit field descriptions 


ID_PFR0O is a 32-bit register, and must be interpreted with ID_PFR1. It is part of the Identification 
registers functional group. 


This register is Read Only. 


31 28 27 1615 12 11 8 7 4 3 0 
RAS ia states | state | state | state 


RESO 


Figure B1-58 ID_PFRO bit assignments 

RAS, [31:28] 

RAS extension version. The value is: 

@x1 Version | of the RAS extension is present. 
RESO, [27:16] 

RESO Reserved. 
State3, [15:12] 

Indicates support for Thumb Execution Environment (T32EE) instruction set. This value is: 


exe Core does not support the T32EE instruction set. 


State2, [11:8] 
Indicates support for Jazelle. This value is: 


ex1 Core supports trivial implementation of Jazelle. 


Statel, [7:4] 
Indicates support for T32 instruction set. This value is: 


@x3 Core supports T32 encoding after the introduction of Thumb-2 technology, and for all 
16-bit and 32-bit T32 basic instructions. 


State0, [3:0] 
Indicates support for A32 instruction set. This value is: 
ex1 A32 instruction set implemented. 


Configurations 


ID_PFR0O is architecturally mapped to AArch64 register ID _PFRO ELI. See 
B2.79 ID_PFRO_EL1, AArch32 Processor Feature Register 0, ELI on page B2-419. 


There is one copy of this register that is used in both Secure and Non-secure states. 
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B1 AArch32 system registers 
B1.73 ID_PFRO, Processor Feature Register 0 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.74 ID_PFR1, Processor Feature Register 1 





B1.74 ID _PFR1, Processor Feature Register 1 
The ID_PFR1 provides information about the programmers model and architecture extensions supported 
by the core. 
Bit field descriptions 
ID_PFR1 is a 32-bit register, and must be interpreted with ID_PFRO. It is part of the Identification 
registers functional group. 
This register is Read Only. 
31 28 27 20 19 16.15 12.11 8 7 4 3 0 
pocoru| [owner |_| uretios] sony | oats 
Virtualization — 
RESO 
Figure B1-59 ID_PFR1 bit assignments 
GIC CPU, [31:28] 
GIC CPU support: 
@x@ GIC CPU interface is disabled, GICCDISABLE is HIGH. 
@x1 GIC CPU interface is enabled, GICCDISABLE is LOW. 
RESO, [27:20] 
RESO Reserved. 
GenTimer, [19:16] 
Generic Timer support: 
@x1 Generic Timer is implemented. 
Virtualization, [15:12] 
Indicates support for Virtualization: 
ex1 The following Virtualization is implemented: 
¢ The SCR.SIF bit. 
¢ The modifications to the SCR.AW and SCR.FW bits described in the Virtualization 
Extensions. 
¢ The MSR (Banked register) and MRS (Banked register) instructions. 
¢« The ERET instruction. 
¢ EL2, Hyp mode, the HVC instruction implemented. 
MProgMod, [11:8] 
M profile programmers model support: 
@xe Not supported. 
Security, [7:4] 
Security support: 
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B1 AArch32 system registers 
B1.74 ID_PFR1, Processor Feature Register 1 


ex1 The following Security items are implemented: 


ProgMod, [3:0] 


The VBAR register. 

The TTBCR.PDO and TTBCR.PD1 bits. 

The ability to access Secure or Non-secure physical memory is supported. 
EL3, Monitor mode, the SMC instruction implemented. 


Indicates support for the standard programmers model for Armv4 and later. 


Model must support User, FIQ, IRQ, Supervisor, Abort, Undefined and System modes: 


@x1 Supported. 


Configurations 


ID_PFR1 is architecturally mapped to AArch64 register ID PFR1_EL1. See 
B2.80 ID_PFRI_EL1, AArch32 Processor Feature Register 1, EL1 on page B2-421. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.75 IFSR, Instruction Fault Status Register 


B1.75 _IFSR, Instruction Fault Status Register 


The IFSR holds status information about the last instruction fault. 


Bit field descriptions 
IFSR is a 32-bit register, and is part of the Exception and fault handling registers functional group. 


There are two formats for this register. The current translation table format determines which format of 
the register is used. 


¢ B1.75.1 IFSR with Short-descriptor translation table format on page B1-245. 
¢ B1.75.2 IFSR with Long-descriptor translation table format on page B1-245. 


Configurations 


IFSR (NS) is architecturally mapped to AArch64 register IFSR32_EL2. See 
B2.82 IFSR32_EL2, Instruction Fault Status Register, EL2 on page B2-424. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 


¢ B1.75.1 IFSR with Short-descriptor translation table format on page B1-245. 
¢ B1.75.2 IFSR with Long-descriptor translation table format on page B1-245. 


B1.75.1 IFSR with Short-descriptor translation table format 
IFSR has a specific format when using the Short-descriptor translation table format. 


The following figure shows the IFSR bit assignments when using the Short-descriptor translation table 
format. 


When TTBCR.EAE== 


31 171615 131211109 8 


[Se 


Fnv— ExT— L_LPAE 
FS|4] 
RESO 


Figure B1-60 IFSR bit assignments for Short-descriptor translation table format 
ExT, [12] 
External abort type. 


Read as zero. 


For aborts other than external aborts, this bit always returns 0. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


B1.75.2  IFSR with Long-descriptor translation table format 
IFSR has a specific format when using the Long-descriptor translation table format. 


The following figure shows the IFSR bit assignments when using the Long-descriptor translation table 
format. 
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B1 AArch32 system registers 
B1.75 IFSR, Instruction Fault Status Register 


When TTBCR.EAE==1: 


31 171615 131211109 8 
Fnv — L_exT L_LPAE 
RESO 


Figure B1-61 IFSR bit assignments for Long-descriptor translation table format 
ExT, [12] 
External abort type. 


Read as zero. 


For aborts other than external aborts, this bit always returns 0. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.76 MIDR, Main ID Register 


MIDR, Main ID Register 


The MIDR provides identification information for the core, including an implementer code for the device 
and a device ID number. 


Bit field descriptions 
MIDR is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 24 23 20 19 1615 4 3 0 


Figure B1-62 MIDR bit assignments 
Implementer, [31:24] 
Indicates the implementer code. This value is: 


@x41 ASCII character 'A' - implementer is Arm Limited. 


Variant, [23:20] 


Indicates the variant number of the core. This is the major revision number 7 in the rn part of the 
rnpm description of the product revision status. This value is: 


@x2 12p0. 


Architecture, [19:16] 
Indicates the architecture code. This value is: 


@xF Defined by ID registers. 


PartNum, [15:4] 
Indicates the primary part number. This value is: 
@xD@5 Cortex-A55 core. 
Revision, [3:0] 
Indicates the minor revision number of the core. This is the minor revision number m in the pm 
part of the rnpm description of the product revision status. This value is: 


@x® 12p0. 


Configurations 
MIDR is: 
¢ Architecturally mapped to the AArch64 MIDR_ ELI register. See B2.89 MIDR_ELI, Main 
ID Register, ELI on page B2-433. 
¢ Architecturally mapped to external MIDR_ELI register. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.77 MPIDR, Multiprocessor Affinity Register 


MPIDR, Multiprocessor Affinity Register 


The MPIDR provides an additional core identification mechanism for scheduling purposes in a cluster. 
EDDEVAFFO is a read-only copy of MPIDR accessible from the external debug interface. 


Bit field descriptions 
MPIDR is a 32-bit register, and is part of the Identification registers functional group. 


This register is Read Only. 


31 30 29 25 24 23 16.15 8 7 0 
1 
mMT— 
RESO 
RES1 


Figure B1-63 MPIDR bit assignments 


RESI, [31] 
RES1. 


U, [30] 
Indicates a uniprocessor system, as distinct from core 0 in a multiprocessor system. This value 
is: 
@be Core is part of a multiprocessor system. 

RESO, [29:25] 


RESO Reserved. 


MT, [24] 


Indicates whether the lowest level of affinity consists of logical cores that are implemented 
using a multi-threading type approach. This value is: 


@b1 Affinity 0 represents threads. However, Cortex-A55 is not multithreaded and so 
affinity 0 will always be zero. This allows consistency when in a system with other 
cores that are multithreaded. 


Aff2, [23:16] 
Affinity level 2. This level of affinity identifies different clusters within the system. The value in 
this field is equal to the value present on the CLUSTERIDFAFF? configuration signal. 


Aff1, [15:8] 
Affinity level 1. This level of affinity identifies individual cores within the local DynamIQ 
cluster. The value can range from @x@@ for core 0, to @x@7 for core 7. 


Aff0, [7:0] 
Affinity level 0. The level identifies individual threads within a multi-threaded core. The 
Cortex-A55 core is single-threaded, so this field has the value 0xee. 
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B1 AArch32 system registers 
B1.77 MPIDR, Multiprocessor Affinity Register 
Configurations 
The MPIDR is: 
¢ Architecturally mapped to the AArch64 MPIDR_EL1[31:0] register. See 


B2.90 MPIDR_ELI, Multiprocessor Affinity Register, ELI] on page B2-434. 
* Mapped to external EDDEVAFFO register. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.78 PAR, Physical Address Register 


B1.78 PAR, Physical Address Register 


The PAR returns the output address (OA) from an address translation instruction that executed 
successfully, or fault information if the instruction did not execute successfully. 


Configuration Details 


PAR is a 64-bit register that can also be accessed as a 32-bit value. If it is accessed as a 32-bit register, 
accesses read and write bits[31:0] and do not modify bits[63:32]. 


PAR is part of the Address translation instructions functional group. 
Configurations 


AArch32 System register PAR is architecturally mapped to AArch64 System register PAR_EL1. 
See B2.9/ PAR_ELI, Physical Address Register, ELI on page B2-436. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 
¢ B1.78.1 PAR with Short-descriptor translation table format on page B1-250. 
¢ B1.78.2 PAR with Long-descriptor translation table format on page B1-252. 


B1.78.1 PAR with Short-descriptor translation table format 
PAR details when the PE is using the Short-descriptor translation table format. 


F, [0] 
Indicates whether the instruction performed a successful address translation. 
) Address translation completed successfully. 
1 Address translation aborted. 


Bit field descriptions, PAR.F is 0 
The following figure shows the PAR bit assignments when PAR.F is 0. 


31 TH) TdF 


LPAE eal 
nos | 
ss 0] 
IMP oe Inner[2:0] 


Figure B1-64 PAR bit assignments, PAR.F is 0 


PA, [31:12] 
Output address. The output address (OA) corresponding to the supplied input address. This field 
returns address bits[31:12]. 





LPAE, [11] 
7) Short-descriptor translation table format used. This means that the PAR returned a 32- 
bit value. 
NOS, [10] 
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B1 AArch32 system registers 
B1.78 PAR, Physical Address Register 


Not Outer Shareable. When the returned value of PAR.SH is 1, indicates the Shareability 
attribute for the physical memory region: 


7) Memory region is Outer Shareable. 
1 Memory region is Inner Shareable. 
NS, [9] 
Non-secure. The NS attribute for a translation table entry from a Secure translation regime. 


For a result from a Secure translation regime, this bit reflects the Security state of the physical 
address space of the translation. This means it reflects the effect of the NSTable bits of earlier 
levels of the translation table walk if those NSTable bits effect the translation. 


IMP DEF, [8] 


IMPLEMENTATION DEFINED. Bit[8] is RESO. See the Arm® Architecture Reference Manual Armvé, for 
Armv8-A architecture profile for more information. 


SH, [7] 
Shareability. Indicates whether the physical memory region is Non-shareable: 
) Memory is Non-shareable. 
1 Memory is shareable, and PAR.NOS indicates whether the region is Outer Shareable 


or Inner Shareable. 
Inner[2:0], [6:4] 
Inner cacheability attribute for the region. Permitted values are: 
eee Non-cacheable. 
001 Device-nGnRnE. 
Q11 Device-nGnRE. 
101 Write-Back, Write-Allocate. 


110 Write-Through. 
111 Write-Back, no Write-Allocate. 


The values 010 and 100 are reserved. 


Outer[1:0], [3:2] 


ee Non-cacheable. 
@1 Write-Back, Write-Allocate. 
10 Write-Through, no Write-Allocate. 
11 Write-Back, no Write-Allocate. 
SS, [1] 
Supersection. Used to indicate if the result is a Supersection: 
() Result is not a Supersection. PAR[31:12] contains OA[31:12]. 
1 Result is a Supersection, and: 


¢ PAR[31:24] contains OA[31:24]. 
¢ PAR[23:16] contains OA[39:32]. 
¢ PAR[15:12] contains @beeee. 


If an implementation supports less than 40 bits of physical address, the bits in the PAR 
field that correspond to physical address bits that are not implemented are UNKNOWN 


F, [0] 
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B1 AArch32 system registers 
B1.78 PAR, Physical Address Register 


Indicates whether the instruction performed a successful address translation. 


) Address translation completed successfully. 


Bit field descriptions, PAR.F is 1 
The following figure shows the PAR bit assignments when PAR.F is 1. 


31 1211109876543 210 
ee ee 
LPAE 
RESO 


Figure B1-65 PAR bit assignments, PAR.F is 1 
RESO, [31:12] 


RESO Reserved. 


LPAE, [11] 
7) Short-descriptor translation table format used. This means that the PAR returned a 32- 
bit value. 
RESO, [10:7] 


RESO Reserved. 


FS, [6:1] 
Fault status bits. Bits [12,10,3:0] from the DFSR, indicating the source of the abort. 


F, [0] 
Indicates whether the instruction performed a successful address translation. 


1 Address translation aborted. 


B1.78.2. PAR with Long-descriptor translation table format 


PAR details when the PE is using the Long-descriptor translation table format. 


F, [0] 
Indicates whether the instruction performed a successful address translation. 
) Address translation completed successfully. 
1 Address translation aborted. 


Bit field descriptions, PAR.F is 0 
The following figure shows the PAR bit assignments when PAR.F is 0. 
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B1 AArch32 system registers 
B1.78 PAR, Physical Address Register 


63 56 55 40 39 1211109 8 7 6 1 (0 
| a 


LPAE — 
IMP DEF 
NS 


Figure B1-66 PAR bit assignments, PAR.F is 0 






ATTR PA 


RESO 


ATR, [63:56] 
Memory attributes for the returned output address. This field uses the same encoding as the 
Attr<n> fields in MAIRO and MAIRI. 


RESO, [55:40] 


RESO Reserved. 


PA, [39:12] 
Output address. The output address (OA) corresponding to the supplied input address. This field 
returns address bits[3 1:12]. 


LPAE, [11] 


1 Long-descriptor translation table format used. This means that the PAR returned a 64- 
bit value. 


IMP DEF, [10] 
IMPLEMENTATION DEFINED. 
NS, [9] 
Non-secure. The NS attribute for a translation table entry from a Secure translation regime. 


For a result from a Secure translation regime, this bit reflects the Security state of the physical 
address space of the translation. This means it reflects the effect of the NSTable bits of earlier 
levels of the translation table walk if those NSTable bits effect the translation. 


For a result from a Non-secure translation regime, this bit is UNKNOWN. 


SH, [8:7] 
Shareability attribute, for the returned output address. Permitted values are: 
Js) Non-shareable. 
10 Outer Shareable. 
11 Inner Shareable. 


The value 01 is reserved. 


RESO, [6:1] 


RESO Reserved. 





F, [0] 
Indicates whether the instruction performed a successful address translation. 
) Address translation completed successfully. 
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B1 AArch32 system registers 
B1.78 PAR, Physical Address Register 


Bit field descriptions, PAR.F is 1 
The following figure shows the PAR bit assignments when PAR.F is 1. 


1211109 8 7 6 


|S SS = 


LPAE = | 
rence —| | 
S2WLK 


RESO 


Figure B1-67 PAR bit assignments, PAR.F is 1 
RESO, [63:12] 


RESO Reserved. 


LPAE, [11] 
1 Long-descriptor translation table format used. This means the PAR returned a 64-bit 
value. 
RESO, [10] 


RESO Reserved. 


FSTAGE, [9] 


Indicates the translation stage at which the translation aborted: 


() Translation aborted because of a fault in the stage | translation. 
1 Translation aborted because of a fault in the stage 2 translation. 
S2WLK, [8] 


If this bit is set to 1, it indicates the translation aborted because of a stage 2 fault during a stage | 
translation table walk. 


RESO, [7] 
RESO Reserved. 
FST, [6:1] 


Fault status field. Values are as in the DFSR.STATUS and IFSR.STATUS fields when using the 
Long-descriptor translation table format. 





F, [0] 
Indicates whether the instruction performed a successful address translation. 
1 Address translation aborted. 
100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-254 
reserved. 


Non-Confidential 


B1 AArch32 system registers 
B1.79 REVIDR, Revision ID Register 


B1.79 REVIDR, Revision ID Register 


The REVIDR provides revision information, additional to that in the MIDR, which identifies minor fixes 
(errata) which may be present in a specific implementation of the Cortex-A55 core. 


Bit field descriptions 
REVIDR is a 32-bit register, and is part of the Identification registers functional group. 


This register is Read Only. 


31 0 


IMPLEMENTATION DEFINED 


Figure B1-68 REVIDR bit assignments 
IMPLEMENTATION DEFINED, [31:0] 
IMPLEMENTATION DEFINED. 


Configurations 


AArch32 System register REVIDR is architecturally mapped to AArch64 System register 
REVIDR_ ELI. See B2.92 REVIDR_ELI, Revision ID Register, EL] on page B2-437. 


There is one instance of this register that is used in both Secure and Non-secure states. 
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B1 AArch32 system registers 
B1.80 SCR, Secure Configuration Register 


B1.80 SCR, Secure Configuration Register 


The SCR defines the configuration of the current Security state when EL3 is implemented and can use 
AArch32. 


It specifies: 


¢ The Security state, either Secure or Non-secure. 
¢ What mode the core branches to if an IRQ, FIQ, or External Abort occurs. 
¢ Whether the CPSR.F or CPSR.A bits can be modified when SCR.NS==1. 


Bit field descriptions 
SCR is a 32-bit register. 


31 14131211109 8 76543210 





TWwe— L_NS 
Tw IRQ 
FIQ 

EA 
FW 
AW 
nET 
SCD 
HCE 

SIF 


RESO 


























Figure B1-69 SCR bit assignments 
This register resets to value 0x@0000008. 


Configurations 
This register is only accessible in Secure state. 


AArch32 System register SCR can be mapped to AArch64 System register SCR_EL3, but this 
is not architecturally mandated. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1 AArch32 system registers 
B1.81 SCTLR, System Control Register 


B1.81 SCTLR, System Control Register 


The SCTLR provides the top-level control of the system, including its memory system. 


Bit field descriptions 


SCTLR is a 32-bit register, and is part of the Other system control registers functional group. 


31 30 29 28 27 26 25 24 23 22 21 20191817 161514131211109 8 76543210 





TE a EE = | L nTWI SED zal Es nTLSMD 
AFE SPAN nTWE ITD LSMAOE 
TRE WXN CP15BEN 


UWXN UNK 
RES1 


RESO 


Figure B1-70 SCTLR bit assignments 

TE, [30] 

T32 Exception enable. 

This field resets to a value determined by the input configuration signal cfgte_i. 
AFE, [29] 

Access Flag Enable. 

This field resets to 0. 
TRE, [28] 

TEX remap enable. 

This field resets to 0. 
EE, [25] 

Exception Endianness bit. 

This field resets to a value determined by the input configuration signal efgend_i. 


SPAN, [23] 


This field resets to 1. 
UWXN, [20] 
Unprivileged write permission implies PL1 XN (Execute-never). 
This field resets to 0. 
WXN, [19] 
Write permission implies XN (Execute-never). 
This field resets to 0. 
nTWE, [18] 
Traps PLO execution of WFE instructions to Undefined mode. 


This field resets to 1. 
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B1.81 SCTLR, System Control Register 


nTWI, [16] 
Traps PLO execution of WFI instructions to Undefined mode. 
This field resets to 1. 

V, [13] 
Vectors bit. 


This field resets to a value determined by the input configuration signal vinithi_i. 


I, [12] 
Instruction access Cacheability control, for accesses at EL1 and ELO. 
This field resets to 0. 
SED, [8] 
SETEND instruction disable. Disables SETEND instructions at PLO and PL1: 
) SETEND instruction execution is enabled at PLO and PL1. 
1 SETEND instructions are UNDEFINED at PLO and PL1. 
This field resets to 0. 
ITD, [7] 
RESO AILIT instruction functionality is always implemented in PLO, PL1 and enabled at 
PL2. 
UNK, [6] 


Writes to this bit are IGNORED. Reads of this bit return an UNKNOWN value. 
CP15BEN, [5] 


System instruction memory barrier enable. Enables accesses to the DMB, DSB, and ISB System 
instructions in the (coproc==1111) encoding space from PL1 and PLO. 


() PLO and PL1 execution of the CP1SDMB, CP15DSB, and CP15ISB instructions is 
UNDEFINED. 

1 PLO and PL1 execution of the CP1SDMB, CP15DSB, and CP15ISB instructions is 
enabled. 


This field resets to 1. 


LSMAOE, [4] 
Load/Store Multiple Atomicity and Ordering Enable. 


RES! This bit is not controllable. The ordering and interrupt behavior of Load/Store 
Multiple is as defined for Armv8-A. 


nTLSMD, [3] 
no Trap Load/Store Multiple to Device-nGRE/Device-nGnRE/Device-nGnRnE memory. 


RES1 This bit is not controllable. Load/Store Multiple to memory marked at stage1 as 
Device-nGRE/Device-nGnRE/Device-nGnRnE memory does not generate a stage | 
alignment fault as a result of this mechanism. 





C, [2] 
Cacheability control, for data accesses at EL1 and ELO. 
This field resets to 0. 
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B1 AArch32 system registers 
B1.81 SCTLR, System Control Register 


A, [1] 
Alignment check enable. 
This field resets to 0. 
M, [0] 
MMU enable for EL1 and ELO stage | address translation. 
This field resets to 0. 
Configurations 


SCTLR (NS) is architecturally mapped to AArch64 register SCTLR_EL1. See 
B2.94 SCTLR_EL1, System Control Register, ELI on page B2-439. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B1.82 SDCR, Secure Debug Control Register 


The SDCR Controls debug and performance monitors functionality in Secure state. 


Bit field descriptions 
SDCR is a 32-bit register, and is part of: 


EPMAD, [21] 


31 


The Debug registers functional group. 
The Security registers functional group. 


22 21 20 19 18 17 16 15 14 13 0 


Po TT 


EPMAD— | | Lspp 
EDAD SPME 





RESO 


Figure B1-71 SDCR bit assignments 


External debugger access to Performance Monitors registers disabled. This disables access to 
these registers by an external debugger: 


@be 


@b1 


EDAD, [20] 


Access to Performance Monitors registers from external debugger is permitted. This is 
the reset value. 


Access to Performance Monitors registers from external debugger is disabled, unless 
overridden by authentication interface. 


External debugger access to breakpoint and watchpoint registers disabled. This disables access 
to these registers by an external debugger: 


@be 


@b1 


SPME, [17] 


Access to breakpoint and watchpoint registers from external debugger is permitted. 
This is the reset value. 


Access to breakpoint and watchpoint registers from external debugger is disabled, 
unless overridden by authentication interface. 


Secure performance monitors enable. This allows event counting in Secure state: 


@be 
@b1 


SPD, [15:14] 


Event counting prohibited in Secure state. This is the reset value. 


Event counting allowed in Secure state. 


AArch32 Secure privileged debug. Enables or disables debug exceptions from Secure state, 
other than Breakpoint Instruction exceptions. Valid values for this field are: 


@bee 


@b10 


@b11 


Legacy mode. Debug exceptions from Secure EL1 are enabled by the authentication 
interface. This is the reset value. 


Secure privileged debug disabled. Debug exceptions from Secure EL] are disabled. 


Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled. 
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B1 AArch32 system registers 
B1.82 SDCR, Secure Debug Control Register 


Configurations 


SDCR is mapped to AArch64 register MDCR_EL3. See B2.88 MDCR_EL3, Monitor Debug 
Configuration Register, EL3 on page B2-431. 


The SDCR is only accessible in Secure state. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.83  TTBCR, Translation Table Base Control Register 


The TTBCR determines which of the translation table base registers defines the base address for a 
translation table walk required for the stage | translation of a memory access from any mode other than 
Hyp mode. 


Also controls the translation table format and, when using the Long-descriptor translation table format, 
holds cacheability and shareability information. 


Bit field descriptions 
TTBCR is a 32-bit register, and is part of the Virtual memory control registers functional group. 


There are two formats for this register. TTBCR.EAE determines which format of the register is used. 
¢ B1.83.1 TTBCR with Short-descriptor translation table format on page B1-262. 
¢ B1.83.2 TTBCR with Long-descriptor translation table format on page B1-263. 


Configurations 


TTBCR (NS) is architecturally mapped to AArch64 register TCR_EL1[31:0]. See 
B2.97 TCR_ELI, Translation Control Register, EL] on page B2-442. 


TTBCR (S) is architecturally mapped to AArch64 register TCR_EL3[31:0]. See 
B2.99 TCR_EL3, Translation Control Register, EL3 on page B2-448. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 


¢ B1.83.1 TTBCR with Short-descriptor translation table format on page B1-262. 
¢ BI1.83.2 TTBCR with Long-descriptor translation table format on page B1-263. 


B1.83.1 |§TTBCR with Short-descriptor translation table format 


TTBCR has a specific format when using the Short-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The following figure shows the TTBCR bit assignments when TTBCR.EAE is 0. 


31 30 65 43 2 0 


L_EAE ppi— 
PDO 


RESO 


Figure B1-72 TTBCR bit assignments, TTBCR.EAE is 0 
EAE, [31] 
Extended Address Enable. 
@be Use the 32-bit translation system, with the Short-descriptor translation table format. 
RESO, [30:6] 


RESO Reserved. 


PD1, [5] 
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Translation table walk disable for translations using TTBR1. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 
TTBRI1. The possible values are: 


@be Perform translation table walks using TTBR1. 


@b1 A TLB miss on an address that is translated using TTBR1 generates a Translation 
fault. No translation table walk is performed. 


PDO, [4] 


Translation table walk disable for translations using TTBRO. This bit controls whether a 
translation table walk is performed on a TLB miss for an address that is translated using 
TTBRO. The possible values are: 


@be Perform translation table walks using TTBRO. 


@b1 A TLB miss on an address that is translated using TTBRO generates a Translation 
fault. No translation table walk is performed. 


RESO, [3] 
RESO Reserved. 
N, [2:0] 


Indicate the width of the base address held in TTBRO. In TTBRO, the base address field is 
bits[31:14-N]. The value of N also determines: 


¢ Whether TTBRO or TTBR1 is used as the base address for translation table walks. 
¢ The size of the translation table pointed to by TTBRO. 


N can take any value from 0 to 7, that is, from @b@@@ to @b111. 
When N has its reset value of 0, the translation table base is compatible with Armv5 and Armv6. 


Resets to 0. 


B1.83.2 TTBCR with Long-descriptor translation table format 


TTBCR has a specific format when using the Long-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The following figure shows the TTBCR bit assignments when TTBCR.EAE is 1. 


31 30 29 28 27 26 25 24 23 22 21 1918 161514131211109 8 7 6 3 2 0 





L_ EAE L_eEpp1 L_EPDO 
IRGN1 IRGNO 
ORGN1 ORGNO 


RESO 


Figure B1-73 TTBCR bit assignments, TTBCR.EAE is 1 





EAE, [31] 
Extended Address Enable: 
@b1 Use the VMSAv8-32 translation system, with the Long-descriptor translation table 

format. 

RESO, [30] 

RESO Reserved. 
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SHI, [29:28] 


Shareability attribute for memory associated with translation table walks using TTBR1: 


e@bee Non-shareable. 
@b10 Outer Shareable. 
@b11 Inner Shareable. 


Other values are reserved. 
Resets to 0. 
ORGNI, [27:26] 


Outer cacheability attribute for memory associated with translation table walks using TTBR1: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
Resets to 0. 


IRGNI, [25:24] 


Inner cacheability attribute for memory associated with translation table walks using TTBR1: 


@bee Normal memory, Inner Non-cacheable. 
@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
Resets to 0. 

EPD1, [23] 


Translation table walk disable for translations using TTBR1. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 


TTBRI: 
@be Perform translation table walks using TTBR1. 
@b1 A TLB miss on an address that is translated using TTBR1 generates a Translation 
fault. No translation table walk is performed. 
Al, [22] 
Selects whether TTBRO or TTBR1 defines the ASID: 
@be TTBRO.ASID defines the ASID. 
@b1 TTBRI.ASID defines the ASID. 


RESO, [21:19] 
RESO Reserved. 

TISZ, [18:16] 
The size offset of the memory region addressed by TTBR1. The region size is 232-1!S7 bytes. 
Resets to 0. 

RESO, [15:14] 


RESO Reserved. 
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B1.83 TTBCR, Translation Table Base Control Register 


SHO, [13:12] 


Shareability attribute for memory associated with translation table walks using TTBRO: 


e@bee Non-shareable. 
@b10 Outer Shareable. 
@b11 Inner Shareable. 


Other values are reserved. 
Resets to 0. 
ORGNO, [11:10] 


Outer cacheability attribute for memory associated with translation table walks using TTBRO: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
Resets to 0. 


IRGNO, [9:8] 


Inner cacheability attribute for memory associated with translation table walks using TTBRO: 


@bee Normal memory, Inner Non-cacheable. 
@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
Resets to 0. 

EPDO, [7] 


Translation table walk disable for translations using TTBRO. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 





TTBRO: 
@be Perform translation table walks using TTBRO. 
@b1 A TLB miss on an address that is translated using TTBRO generates a Translation 
fault. No translation table walk is performed. 

RESO, [6:3] 
RESO Reserved. 

TOSZ, [2:0] 
The size offset of the memory region addressed by TTBRO. The region size is 232-1°S7 bytes. 
Resets to 0. 
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B1.84 TTBCR2, Translation Table Base Control Register 2 


The TTBCR2 indicates the hierarchical permission disable and the page based hardware attributes. 


Bit field descriptions 


TTBCR2 is a 32-bit register, and is part of the Virtual memory control registers functional group. 


31 19181716151413121110 9 8 0 


Hwu162—! L_HPDO 
HWU161 HPD1 
HWU160 

HWU159 
HWU062 
HWU061 
HWUO060 
HWU059 














RESO 


Figure B1-74 TTBCR2 bit assignments 
RESO, [31:19] 
RESO Reserved. 
HWU162, [18] 


Indicates implementation defined hardware use of bit[62] of the stage! translation table block or 
level 3 entry. The possible values are: 


7) The associated stage | translation table entry bit cannot be interpreted by hardware for 
an implementation defined purpose. 


1 The associated stage | translation table entry bit can be interpreted by hardware for an 
implementation defined purpose if the associated TTBCR2.HPD1 ==1. 
HWU161, [17] 


Indicates implementation defined hardware use of bit[61] of the stage1 translation table block or 
level 3 entry. The possible values are: 


7) The associated stage | translation table entry bit cannot be interpreted by hardware for 
an implementation defined purpose. 


1 The associated stage | translation table entry bit can be interpreted by hardware for an 
implementation defined purpose if the associated TTBCR2.HPD1 ==1. 
HWU160, [16] 


Indicates implementation defined hardware use of bit[60] of the stage! translation table block or 
level 3 entry. The possible values are: 


7) The associated stage | translation table entry bit cannot be interpreted by hardware for 
an implementation defined purpose. 


1 The associated stage | translation table entry bit can be interpreted by hardware for an 
implementation defined purpose if the associated TTBCR2.HPD1 ==1. 


HWuU159, [15] 
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Indicates implementation defined hardware use of bit[59] of the stage1 translation table block or 
level 3 entry. The possible values are: 


7) The associated stage | translation table entry bit cannot be interpreted by hardware for 
an implementation defined purpose. 


1 The associated stage 1 translation table entry bit can be interpreted by hardware for an 
implementation defined purpose if the associated TTBCR2.HPD1 ==1. 


HWvU062, [14] 


Indicates implementation defined hardware use of bit[62] of the stage1 translation table block or 
level 3 entry. The possible values are: 


7) The associated stage | translation table entry bit cannot be interpreted by hardware for 
an implementation defined purpose. 


1 The associated stage | translation table entry bit can be interpreted by hardware for an 
implementation defined purpose if the associated TTBCR2.HPDO ==1. 


HWvUO061, [13] 


Indicates implementation defined hardware use of bit[61] of the stage1 translation table block or 
level 3 entry. The possible values are: 


7) The associated stage | translation table entry bit cannot be interpreted by hardware for 
an implementation defined purpose. 


1 The associated stage | translation table entry bit can be interpreted by hardware for an 
implementation defined purpose if the associated TTBCR2.HPDO ==1. 


HWwU060, [12] 


Indicates implementation defined hardware use of bit[60] of the stage1 translation table block or 
level 3 entry. The possible values are: 


7) The associated stage 1 translation table entry bit cannot be interpreted by hardware for 
an implementation defined purpose. 


1 The associated stage | translation table entry bit can be interpreted by hardware for an 
implementation defined purpose if the associated TTBCR2.HPDO ==1. 


HWuwu059, [11] 


Indicates implementation defined hardware use of bit[59] of the stagel translation table block or 
level 3 entry. The possible values are: 


7) The associated stage | translation table entry bit cannot be interpreted by hardware for 
an implementation defined purpose. 


1 The associated stage 1 translation table entry bit can be interpreted by hardware for an 
implementation defined purpose if the associated TTBCR2.HPDO ==1. 





HPD1, [10] 
Hierarchical permission disable 1. The possible values are: 
0 Hierarchical permissions for the TTBR1 region are enabled. 
1 Hierarchical permissions for the TTBR1 region are disabled if TTBCR.T2E is set to 1. 

If TTBCR.T2E is set to 0, hierarchical permissions are enabled. 

HPDO, [9] 
Hierarchical permission disable 0. The possible values are: 
0 Hierarchical permissions for the TTBRO region are enabled. 
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1 Hierarchical permissions for the TTBRO region are disabled if TTBCR.T2E is set to 1. 
If TTBCR.T2E is set to 0, hierarchical permissions are enabled. 
RESO, [8:0] 
RESO Reserved. 


Configurations TTBCR2 (NS) is architecturally mapped to AArch64 register TCR_EL1. See 
B2.97 TCR_ELI, Translation Control Register, ELI on page B2-442. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.85 TTBRO, Translation Table Base Register 0 


The TTBRO holds the base address of translation table 0, and information about the memory it occupies. 
This is one of the translation tables for the stage | translation of memory accesses from modes other than 
Hyp mode. 

Usage constraints 

TTBRO is part of the Virtual memory control registers functional group. 


There are two formats for this register. TTBCR.EAE determines which format of the register is used. 
¢ B1.85.1 TTBRO with Short-descriptor translation table format on page B1-269. 
¢ BI1.85.2 TTBRO with Long-descriptor translation table format on page B1-270. 


Configurations 


TTBRO (NS) is architecturally mapped to AArch64 register TTBRO EL1. See 
B2.100 TTBRO_ELI, Translation Table Base Register 0, EL] on page B2-450. 


TTBRO (S) is mapped to AArch64 register TTBRO_EL3. See B2./02 TTBRO_EL3, Translation 
Table Base Register 0, EL3 on page B2-452. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 
Attributes 


TTBRO is a 64-bit register that can also be accessed as a 32-bit value. If it is accessed as a 32-bit 
register, accesses read and write bits [31:0] and do not modify bits [63:32]. 


TTBCR.EAE determines which TTBRO format is used: 


¢ EAE==0: 
32-bit format is used. TTBRO[63:32] are ignored. 
« EAE==1: 


64-bit format is used. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 
¢ B1.85.1 TTBRO with Short-descriptor translation table format on page B1-269. 
¢ B1.85.2 TTBRO with Long-descriptor translation table format on page B1-270. 


B1.85.1 TTBRO with Short-descriptor translation table format 


TTBRO has a specific format when using the Short-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


Bit field descriptions 


The following figure shows the TTBRO bit assignments when TTBCR.EAE is 0. 
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31 76543 2 1 0 


IRGNIO] —! 
wi 


er 





RESO 


Figure B1-75 TTBRO bit assignments, TTBCR.EAE is 0 
IMP, [2] 


RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


B1.85.2. TTBRO with Long-descriptor translation table format 


TTBRO has a specific format when using the Long-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The Long-descriptor translation table format for TTBRO is architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile for a full description. 


Bit field descriptions 
The following bit is specific to the implementation: 


CnP, [0] 
Common not private. The possible values are: 





0 CnP is not supported. 
1 CnP is supported. 
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B1.86 TTBR1, Translation Table Base Register 1 


The TTBR1 holds the base address of translation table 1, and information about the memory it occupies. 
This is one of the translation tables for the stage 1 translation of memory accesses from modes other than 
Hyp mode. 


Usage constraints 
TTBR1 is part of the Virtual memory control registers functional group. 


There are two formats for this register. TTBCR.EAE determines which format of the register is used. 
¢ B1.86.1 TTBR1 with Short-descriptor translation table format on page B1-271. 
¢ B1.86.2 TTBR1 with Long-descriptor translation table format on page B1-272. 


Configurations 


TTBRI (NS) is architecturally mapped to AArch64 register TTBR1_EL1. See 
B2.103 TTBR1_ELI, Translation Table Base Register 1, EL] on page B2-453. 


If EL3 is using AArch64, there is a single instance of this register. 
Attributes 


TTBRI is a 64-bit register that can also be accessed as a 32-bit value. If it is accessed as a 32-bit 
register, accesses read and write bits [31:0] and do not modify bits [63:32]. 


TTBCR.EAE determines which TTBR1 format is used: 


« EAE==0: 
32-bit format is used. TTBR1[63:32] are ignored. 
« EAE==1: 


64-bit format is used. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 


¢ B1.86.1 TTBR1 with Short-descriptor translation table format on page B1-271. 
¢ B1.86.2 TTBR1 with Long-descriptor translation table format on page B1-272. 


B1.86.1 TTBR1 with Short-descriptor translation table format 


TTBRI has a specific format when using the Short-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


Bit field descriptions 


The following figure shows the TTBR1 bit assignments when TTBCR.EAE is 0. 


31 76543 2 1 0 


IRGN[O] — 
NOS iS 
IRGN[1] 


Figure B1-76 TTBR1 bit assignments, TTBCR.EAE is 0 


RESO 


IMP, [2] 
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RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


B1.86.2. TTBR1 with Long-descriptor translation table format 


TTBRI has a specific format when using the Long-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The Long-descriptor translation table format for TTBR1 is architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile for a full description. 


Bit field descriptions 
The following bit is specific to the implementation: 


CnP, [0] 
Common not private. The possible values are: 





0 CnP is not supported. 
1 CnP is supported. 
100442 0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B1-272 
reserved. 


Non-Confidential 


B1 AArch32 system registers 
B1.87 VDFSR, Virtual SError Exception Syndrome Register 


B1.87 VDFSR, Virtual SError Exception Syndrome Register 


The VDFSR provides the syndrome value reported to software on taking a virtual SError interrupt 
exception. 


Bit field descriptions 

VDEFSR is a 32-bit register, and is part of : 

¢ The Exception and fault handling registers functional group. 
¢ The Virtualization registers functional group. 


31 16.15 14 13 12:11 0 
ee ee 
L_ ExT 
RESO 


Figure B1-77 VDFSR bit assignments 
RESO, [31:16] 
RESO Reserved. 
AET, [15:14] 


Asynchronous Error Type. Describes the state of the core after taking a virtual SError interrupt 
exception. Software might use the information in the syndrome registers to determine what 
recovery might be possible. The value is: 


@be1 Uncorrected error, Unrecoverable error (UEU). 


RESO, [13] 

RESO Reserved. 
ExT, [12] 

External abort type. 


RESO. 


This register is only used for external aborts. 
RESO, [11:0] 


RESO Reserved. 


Configurations 


AArch32 System register VDFSR is architecturally mapped to AArch64 System register 
VSESR_EL2 [31:0]. See B2.108 VSESR_EL2, Virtual SError Exception Syndrome Register 
on page B2-460. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.88 VDISR, Virtual Deferred Interrupt Status Register 


The VDISR records that a virtual SError interrupt has been consumed by an ESB instruction executed at 
Non-secure EL1. 


Bit field descriptions 


VDISR is a 32-bit register, and is part of Reliability, Availability, Serviceability (RAS) registers 
functional group. 


There are two formats for this register. The current translation table format determines which format of 

the register is used: 

¢ When written at EL1 using short-descriptor format. See B/.88.1 VDISR with Short-descriptor 
translation table format on page B1-274 

¢ When written at EL1 using long-descriptor format. See B/.88.2 VDISR with Long-descriptor 
translation table format on page B1-275 


Configurations 
There is one instance of VDISR that is used in both Secure and Non-secure states. 


Present only if all of the following are present and is UNDEFINED otherwise: 
¢ EL2 is implemented and using AArch32. 
¢ The RAS extension is implemented. 


If the highest implemented Exception level is using AArch64, AArch32 System register VDISR 
is architecturally mapped to AArch64 System register VDISR_EL2. See B2./05 VDISR_EL?2, 
Virtual Deferred Interrupt Status Register, EL2 on page B2-455. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 
¢ B1.88.1 VDISR with Short-descriptor translation table format on page B1-274. 
¢ B1.88.2 VDISR with Long-descriptor translation table format on page B1-275. 


B1.88.1  VDISR with Short-descriptor translation table format 


VDISR has a specific format when written at EL1 using the Short-descriptor translation table format. 


Bit field descriptions 


The following figure shows the VDISR bit assignments when using the Short-descriptor translation table 





format. 
31 30 16.15 1413121110 9 8 
eExT—! L_LPAE 
FS(4) 
RESO 
Figure B1-78 VDISR bit assignments for Short-descriptor translation table format 
A, [31] 


Set to 1 when ESB defers a virtual SError interrupt. 
RESO, [30:16] 


RESO Reserved. 
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AET, [15:14] 


Asynchronous Error Type. Describes the state of the PE after taking an asynchronous Data 
Abort exception. The value is: 


@be1 Uncorrected error, Unrecoverable error (UEV). 


RESO, [13] 
RESO Reserved. 
EXT, [12] 
External Abort Type. This bit is defined as REso. 
RESO, [11] 
RESO Reserved. 
FS(4), [10,3:0] 


Fault status code. Set to @b10110 when ESB defers a virtual SError interrupt. The value of this 
field is: 


0b10110 


Asynchronous SError interrupt. 


LPAE, [9] 
Format. The value is: 
@be 
Using the Short-descriptor translation table format. 
RESO, [8:4] 


RESO Reserved. 
B1.88.2  VDISR with Long-descriptor translation table format 
VDISR has a specific format when written at EL1 using the Long-descriptor translation table format. 


Bit field descriptions 


The following figure shows the VDISR bit assignments when using the Long-descriptor translation table 


format. 
31 30 16151413121110 9 8 
ExT! L_LPAE 
RESO 
Figure B1-79 VDISR bit assignments for Long-descriptor translation table format 
A, [31] 


Set to 1 when ESB defers a virtual SError interrupt. 
RESO, [30:16] 


RESO Reserved. 
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B1.88 VDISR, Virtual Deferred Interrupt Status Register 


AET, [15:14] 


Asynchronous Error Type. Describes the state of the PE after taking an asynchronous Data 
Abort exception. The value is: 


@be1 Uncorrected error, Unrecoverable error (UEU). 


RESO, [13] 
RESO Reserved. 
EXT, [12] 
External Abort Type. This bit is defined as REso. 
RESO, [11] 
RESO Reserved. 
RESO, [10] 


RESO Reserved. 


LPAE, [9] 
Format. The value is: 
@b1 
Using the Long-descriptor translation table format. 
RESO, [8:6] 


RESO Reserved. 


STATUS, [5:0] 


Fault status code. Set to @b@10001 when ESB defers a virtual SError interrupt. The value of this 
field is: 


0be10001 


Asynchronous SError interrupt. 
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B1.89 VMPIDR, Virtualization Multiprocessor ID Register 


The VMPIDR provides the value of the Virtualization Multiprocessor ID. This is the value returned by 
Non-secure EL1 reads of MPIDR. 


Configurations 
VMPIDR is architecturally mapped to AArch64 register VMPIDR_EL2[31:0]. 
This register is accessible only at EL2 or EL3. 
This register resets to MPIDR value. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.90 VPIDR, Virtualization Processor ID Register 


The VPIDR holds the value of the Virtualization Processor ID. This is the value returned by Non-secure 
ELI reads of MIDR. 


Configurations 
VPIDR is architecturally mapped to AArch64 register VPIDR_EL2. 
This register resets to MIDR value. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1.91 VTCR, Virtualization Translation Control Register 


B1.91 VTCR, Virtualization Translation Control Register 


The VTCR controls the translation table walks required for the stage 2 translation of memory accesses 
from Non-secure modes other than Hyp mode. 


It also holds cacheability and shareability information for the accesses. 


Bit field descriptions 

VTCR is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Virtual memory control registers functional group. 


31 30 14131211109 8 7 6 5 4 3 


ORGNO — 
IRGNO 


RES1 
RESO 
Figure B1-80 VTCR bit assignments 
RES1, [31] 
RES1 Reserved. 


RESO, [30:14] 
RESO Reserved. 
SHO, [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO. 


@be@ = Non-shareable. 
@b@1_ ~—sCfRReserved. 

@b1@ ~=©Outer Shareable. 
@b11 _—Inner Shareable. 


ORGNDO, [11:10] 
Outer cacheability attribute for memory associated with translation table walks using TTBRO. 


@bee@ Normal memory, Outer Non-cacheable. 

@b@1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


IRGNO, [9:8] 
Inner cacheability attribute for memory associated with translation table walks using TTBRO. 


@bee@ Normal memory, Inner Non-cacheable. 

@b@1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


SLO, [7:6] 
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Starting level for translation table walks using VT TBR: 
@bee _ Start at second level. 
@be1 _ Start at first level. 

RESO, [5] 


RESO Reserved. 


S, [4] 
Sign extension bit. This bit must be programmed to the value of TOSZ[3]. If it is not, then the 
stage 2 TOSZ value is treated as an UNKNOWN value within the legal range that can be 
programmed. 
TOSZ, [3:0] 
The size offset of the memory region addressed by TTBRO. The region size is 232-1°SZ bytes. 
Configurations 


VTCR is architecturally mapped to AArch64 register VTCR_EL2. See 82.109 VTCR_EL2, 
Virtualization Translation Control Register, EL2 on page B2-462. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B1.92 VTTBR, Virtualization Translation Table Base Register 


VTTBR holds the base address of the translation table for the stage 2 translation of memory accesses 
from Non-secure modes other than Hyp mode. 


Bit field descriptions 

VTTBR is a 64-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Virtual memory control registers functional group. 


63 48 47 2 10 
VMID BADDR 


Cnp — 


RESO 


Figure B1-81 VTTBR bit assignments 


CnP, [0] 
Common not Private. The reset value is: 


0 CnP is not supported. 


Configurations 


VTTBR is architecturally mapped to AArch64 register VTTBR_EL1. See 82.//0 VITBR_EL2, 
Virtualization Translation Table Base Register, EL2 on page B2-463. 


This register is used with the VTCR. 


Some or all RW fields of this register have defined reset values. These apply only if the core 
resets into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW 
fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B1.92 VTTBR, Virtualization Translation Table Base Register 





100442 _0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights reserved. B1-282 
Non-Confidential 


Chapter B2 
AArch64 system registers 


This chapter describes the system registers in the AArch64 state. 


It contains the following sections: 

¢ B2.1 AArch64 registers on page B2-286. 

¢ B2.2 AArch64 architectural system register summary on page B2-287. 

¢ B2.3 AArch64 implementation defined register summary on page B2-294. 

¢ B2.4 AArch64 registers by functional group on page B2-296. 

¢ B2.5 ACTLR_ELI, Auxiliary Control Register, ELI on page B2-304. 

¢ B2.6 ACTLR_EL2, Auxiliary Control Register, EL2 on page B2-305. 

¢ B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 on page B2-307. 

¢ B2.8 AFSRO_EL1, Auxiliary Fault Status Register 0, EL1 on page B2-309. 

¢ B2.9 AFSRO_EL2, Auxiliary Fault Status Register 0, EL2 on page B2-310. 

¢ B2.10 AFSRO_EL3, Auxiliary Fault Status Register 0, EL3 on page B2-311. 

¢ B2.11 AFSR1_ELI, Auxiliary Fault Status Register 1, ELI on page B2-312. 

¢ B2.12 AFSR1_EL2, Auxiliary Fault Status Register 1, EL2 on page B2-313. 

¢ B2.13 AFSRI_EL3, Auxiliary Fault Status Register 1, EL3 on page B2-314. 

¢ B2.14 AIDR_ELI, Auxiliary ID Register, EL1 on page B2-315. 

¢ B2.15 AMAIR_ELI, Auxiliary Memory Attribute Indirection Register, EL1 on page B2-316. 
¢ B2.16 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register, EL2 on page B2-317. 
¢ B2.17 AMAIR_EL3, Auxiliary Memory Attribute Indirection Register, EL3 on page B2-318. 
¢ B2.18 ATCR_ELI, Auxiliary Translation Control Register, ELI on page B2-319. 

¢ B2.19 ATCR_EL12, Alias to Auxiliary Translation Control Register ELI on page B2-321. 
¢ B2.20 ATCR_EL2, Auxiliary Translation Control Register, EL2 on page B2-322. 

¢ B2.21 ATCR_EL3, Auxiliary Translation Control Register, EL3 on page B2-324. 

¢ B2.22 AVTCR_EL2, Auxiliary Virtualized Translation Control Register, EL2 on page B2-326. 
¢ B2.23 CCSIDR_ELI, Cache Size ID Register, EL] on page B2-328. 
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¢ B2.24 CLIDR_ELI, Cache Level ID Register, ELI on page B2-331. 

¢ B2.25 CPACR_ELI, Architectural Feature Access Control Register, EL1 on page B2-333. 

¢ B2.26 CPTR_EL2, Architectural Feature Trap Register, EL2 on page B2-334. 

¢ B2.27 CPTR_EL3, Architectural Feature Trap Register, EL3 on page B2-335. 

¢ B2.28 CPUACTLR_ELI, CPU Auxiliary Control Register, ELI on page B2-336. 

¢ B2.29 CPUCFR_ELI, CPU Configuration Register, ELI on page B2-338. 

¢ B2.30 CPUECTLR_ELI, CPU Extended Control Register, ELI on page B2-340. 

¢ B2.31 CPUPCR_EL3, CPU Private Control Register, EL3 on page B2-343. 

¢ B2.32 CPUPMR_EL3, CPU Private Mask Register, EL3 on page B2-345. 

¢ = B2.33 CPUPOR_EL3, CPU Private Operation Register, EL3 on page B2-347. 

¢ B2.34 CPUPSELR_EL3, CPU Private Selection Register, EL3 on page B2-349. 

¢ B2.35 CPUPWRCTLR_ELI, Power Control Register, EL1 on page B2-351. 

¢ B2.36 CSSELR_EL1, Cache Size Selection Register, EL1 on page B2-354. 

¢ B2.37 CTR_ELO, Cache Type Register, ELO on page B2-355. 

¢ B2.38 DCZID_ELO, Data Cache Zero ID Register, ELO on page B2-357. 

¢ B2.39 DISR_ ELI, Deferred Interrupt Status Register, ELI on page B2-358. 

¢ B2.40 ERRIDR_ELI, Error ID Register, ELI on page B2-360. 

¢ B2.41 ERRSELR_EL1, Error Record Select Register, ELI on page B2-361. 

¢ B2.42 ERXADDR_ELI, Selected Error Record Address Register, ELI on page B2-362. 

¢ B2.43 ERXCTLR_ELI, Selected Error Record Control Register, ELI on page B2-363. 

¢ B2.44 ERXFR_ELI, Selected Error Record Feature Register, EL1 on page B2-364. 

¢ B2.45 ERXMISCO_EL1, Selected Error Record Miscellaneous Register 0, EL1 on page B2-365. 

¢ B2.46 ERXMISCI_EL1, Selected Error Record Miscellaneous Register 1, EL1 on page B2-366. 

¢ B2.47 ERXPFGCDNR_ELI, Selected Error Pseudo Fault Generation Count Down Register, EL] 
on page B2-367. 

¢ B2.48 ERXPFGCTLR_ELI, Selected Error Pseudo Fault Generation Control Register, EL1 
on page B2-369. 

¢ B2.49 ERXPFGFR_EL1, Selected Pseudo Fault Generation Feature Register, ELI on page B2-371. 

¢ B2.50 ERXSTATUS_EL1, Selected Error Record Primary Status Register, ELI on page B2-372. 

¢ B2.51 ESR_ELI, Exception Syndrome Register, EL1 on page B2-373. 

¢ B2.52 ESR_EL2, Exception Syndrome Register, EL2 on page B2-374. 

¢ B2.53 ESR_EL3, Exception Syndrome Register, EL3 on page B2-375. 

¢ B2.54 HACR_EL2, Hyp Auxiliary Configuration Register, EL2 on page B2-376. 

¢ B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 on page B2-377. 

¢ B2.56 HPFAR_EL2, Hypervisor IPA Fault Address Register, EL2 on page B2-379. 

¢ B2.57ID_AA64DFRO_EL1, AArch64 Debug Feature Register 0, ELI on page B2-380. 

¢ B2.58 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute Register 0, ELI on page B2-382. 

¢ B2.59ID_AA64ISARI_ ELI, AArch64 Instruction Set Attribute Register 1, ELI on page B2-384. 

¢ B2.60 ID_AA64MMFRO_EL1, AArch64 Memory Model Feature Register 0, ELI on page B2-385. 

¢ B2.61 ID_AA64MMFRI_EL1, AArch64 Memory Model Feature Register 1, ELI on page B2-387. 

¢ B2.62 ID_AA64MMFR2_EL1, AArch64 Memory Model Feature Register 2, EL1 on page B2-389. 

¢ B2.63 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 0, ELI on page B2-390. 

¢ B2.64ID_AA64PFRI_EL1, AArch64 Processor Feature Register 1, ELI on page B2-392. 

¢ B2.65 ID_AFRO_ELI1, AArch32 Auxiliary Feature Register 0, ELI on page B2-393. 

¢ B2.66ID_DFRO_ ELI, AArch32 Debug Feature Register 0, ELI on page B2-394. 

¢ B2.67 ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, ELI on page B2-396. 

¢ B2.68 ID_ISARI ELI, AArch32 Instruction Set Attribute Register 1, ELI on page B2-398. 

¢ B2.69ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 2, ELI on page B2-400. 

¢ B2.70 ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, ELI on page B2-402. 

¢ B2.71 ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4, ELI on page B2-404. 

¢ B2.72 ID_ISARS _EL1, AArch32 Instruction Set Attribute Register 5, EL1 on page B2-406. 

¢ B2.73 ID_ISAR6_EL1, AArch32 Instruction Set Attribute Register 6, ELI on page B2-408. 

¢ B2.74ID_MMFRO_ELI, AArch32 Memory Model Feature Register 0, ELI on page B2-409. 

¢ B2.75 ID _MMFRI_ ELI, AArch32 Memory Model Feature Register 1, EL] on page B2-411. 

¢ B2.76ID_MMFR2 ELI, AArch32 Memory Model Feature Register 2, EL] on page B2-413. 

¢ B2.77 ID _MMFR3_ELI, AArch32 Memory Model Feature Register 3, EL] on page B2-415. 
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B2.78 ID_MMFR4_EL1, AArch32 Memory Model Feature Register 4, ELI on page B2-417. 


B2.79 ID_PFRO_EL1, AArch32 Processor Feature Register 0, ELI on page B2-419. 
B2.80 ID_PFRI_EL1, AArch32 Processor Feature Register 1, ELI on page B2-421. 
B2.81 ID_PFR2_EL1, AArch32 Processor Feature Register 2, ELI on page B2-423. 
B2.82 IFSR32_EL2, Instruction Fault Status Register, EL2 on page B2-424. 

B2.83 LORC_EL1, LORegion Control Register, ELI on page B2-426. 

B2.84 LOREA_EL1I, LORegion End Address Register, ELI on page B2-427. 

B2.85 LORID_EL1, Limited Order Region Identification Register, EL1 on page B2-428. 
B2.86 LORN_EL1, LORegion Number Register, EL1 on page B2-429. 

B2.87 LORSA_EL1, LORegion Start Address Register, EL1 on page B2-430. 

B2.88 MDCR_EL3, Monitor Debug Configuration Register, EL3 on page B2-431. 
B2.89 MIDR_ELI, Main ID Register, EL1 on page B2-433. 

B2.90 MPIDR_EL1, Multiprocessor Affinity Register, ELI on page B2-434. 

B2.91 PAR_ELI, Physical Address Register, ELI on page B2-436. 

B2.92 REVIDR_ ELI, Revision ID Register, ELI on page B2-437. 

B2.93 RVBAR_EL3, Reset Vector Base Address Register, EL3 on page B2-438. 

B2.94 SCTLR_EL1, System Control Register, ELI on page B2-439. 

B2.95 SCTLR_EL2, System Control Register, EL2 on page B2-440. 

B2.96 SCTLR_EL3, System Control Register, EL3 on page B2-441. 

B2.97 TCR_EL1, Translation Control Register, EL1 on page B2-442. 

B2.98 TCR_EL2, Translation Control Register, EL2 on page B2-444. 

B2.99 TCR_EL3, Translation Control Register, EL3 on page B2-448. 

B2.100 TTBRO_EL1, Translation Table Base Register 0, ELI on page B2-450. 
B2.101 TTBRO_EL2, Translation Table Base Register 0, EL2 on page B2-451. 
B2.102 TTBRO_EL3, Translation Table Base Register 0, EL3 on page B2-452. 
B2.103 TTBRI_EL1, Translation Table Base Register 1, ELI on page B2-453. 
B2.104 TTBR1_EL2, Translation Table Base Register 1, EL2 on page B2-454. 
B2.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 on page B2-455. 
B2.106 VMPIDR_EL2, Virtualization Multiprocessor ID Register, EL2 on page B2-458. 
B2.107 VPIDR_EL2, Virtualization Processor ID Register, EL2 on page B2-459. 
B2.108 VSESR_EL2, Virtual SError Exception Syndrome Register on page B2-460. 
B2.109 VTCR_EL2, Virtualization Translation Control Register, EL2 on page B2-462. 


B2.110 VITBR_EL2, Virtualization Translation Table Base Register, EL2 on page B2-463. 
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B2 AArch64 system registers 
B2.1 AArch64 registers 


AArch64 registers 


This chapter provides information about the AArch64 system registers with IMPLEMENTATION DEFINED bit 
fields and IMPLEMENTATION DEFINED registers associated with the core. 


The chapter provides IMPLEMENTATION SPECIFIC information, for a complete description of the registers, see 
the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The chapter is presented as follows: 
AArch64 architectural system register summary 


This section identifies the AArch64 architectural system registers implemented in the Cortex- 
AS55 core that have IMPLEMENTATION DEFINED bit fields. The register descriptions for these registers 
only contain information about the IMPLEMENTATION DEFINED bits. 


AArch64 IMPLEMENTATION DEFINED register summary 


This section identifies the AArch64 architectural registers implemented in the Cortex-A55 core 
that are IMPLEMENTATION DEFINED. 


AArch64 registers by functional group 


This section groups the IMPLEMENTATION DEFINED registers and architectural system registers with 
IMPLEMENTATION DEFINED bit fields, as identified previously, by function. It also provides reset 
details for key register types. 


Register descriptions 


The remainder of the chapter provides register descriptions of the IMPLEMENTATION DEFINED 
registers and architectural system registers with IMPLEMENTATION DEFINED bit fields, as identified 
previously. These are listed in alphabetic order. 
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B2 AArch64 system registers 


B2.2 AArch64 architectural system register summary 















































B2.2 AArch64 architectural system register summary 
This section describes the AArch64 architectural system registers implemented in the Cortex-A55 core. 
The section contains two tables: 
Registers with implementation defined bit fields 
This table identifies the architecturally defined registers in Cortex-A55 that have 
implementation defined bit fields. The register descriptions for these registers only contain 
information about the implementation defined bits. 
See Zable B2-1 Registers with implementation defined bit fields on page B2-287. 
Other architecturally defined registers 
This table identifies the other architecturally defined registers that are implemented in the 
Cortex-A55 core. These registers are described in the Arm® Architecture Reference Manual 
Armvé, for Armv8-A architecture profile. 
See Zable B2-2 Other architecturally defined registers on page B2-291. 
Table B2-1 Registers with implementation defined bit fields 
Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 
ACTLR ELI 3 cl 0 c0 1 64 B2.5 ACTLR_ELI, Auxiliary Control Register, EL1 
on page B2-304 
ACTLR_EL2 3 cl 4 c0 1 64 B2.6 ACTLR_EL2, Auxiliary Control Register, EL2 
on page B2-305 
ACTLR_EL3 3 cl 6 c0 1 64 B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 
on page B2-307 
AIDR_EL1 3 c0 1 c0 7 32 B2.14 AIDR_ELI, Auxiliary ID Register, ELI on page B2-315 
AFSRO_EL1 3 c5 0 cl 0 32 B2.8 AFSRO_EL1, Auxiliary Fault Status Register 0, EL1 
on page B2-309 
AFSRO_EL2 3 c5 4 cl 0 32 B2.9 AFSRO_EL2, Auxiliary Fault Status Register 0, EL2 
on page B2-310 
AFSRO_EL3 3 c5 6 cl 0 32 B2.10 AFSRO_EL3, Auxiliary Fault Status Register 0, EL3 
on page B2-311 
AFSR1_EL1 3 c5 0 cl 1 32 B2.11 AFSR1_EL1, Auxiliary Fault Status Register 1, EL1 
on page B2-312 
AFSR1_EL2 3 c5 4 cl 1 32 B2.12 AFSR1_EL2, Auxiliary Fault Status Register 1, EL2 
on page B2-313 
AFSR1_EL3 3 c5 6 cl 1 32 B2.13 AFSR1_EL3, Auxiliary Fault Status Register 1, EL3 
on page B2-314 
AMAIR EL1 3 cl0 |0 c3 0 64 B2.15 AMAIR_EL1, Auxiliary Memory Attribute Indirection 
Register, ELI on page B2-316 
AMAIR EL2 3 clO |4 c3 0 64 B2.16 AMAIR_EL2, Auxiliary Memory Attribute Indirection 
Register, EL2 on page B2-317 
AMAIR EL3 3 clO |6 c3 0 64 B2.17 AMAIR_EL3, Auxiliary Memory Attribute Indirection 
Register, EL3 on page B2-318 
CCSIDR_EL1 3 c0 1 c0 0 32 B2.23 CCSIDR_ELI, Cache Size ID Register, ELI 
on page B2-328 
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B2 AArch64 system registers 
B2.2 AArch64 architectural system register summary 


Table B2-1 Registers with implementation defined bit fields (continued) 







































































Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 

CLIDR_EL1 3 c0 1 c0 1 64 B2.24 CLIDR_EL1, Cache Level ID Register, EL1 
on page B2-331 

CPACR_EL1 3 cl 0 c0 2 32 B2.25 CPACR_EL1, Architectural Feature Access Control 
Register, ELI on page B2-333 

CPTR_EL2 3 cl 4 cl 2 32 B2.26 CPTR_EL2, Architectural Feature Trap Register, EL2 
on page B2-334 

CPTR_EL3 3 cl 6 cl 2 32 B2.27 CPTR_EL3, Architectural Feature Trap Register, EL3 
on page B2-335 

CSSELR_EL1 3 c0 2 c0 0 32 B2.36 CSSELR_EL1, Cache Size Selection Register, EL1 
on page B2-354 

CTR_ELO 3 c0 3 c0 1 32 B2.37 CTR_ELO, Cache Type Register, ELO on page B2-355 

DISR_EL1 3 cl2 |0 cl 1 64 B2.39 DISR_EL1, Deferred Interrupt Status Register, EL1 
on page B2-358 

ERRIDR_EL1 3 c5 0 c3 0 32 B2.40 ERRIDR_ELI, Error ID Register, ELI on page B2-360 

ERRSELR_ EL1 3 c5 0 c3 1 32 B2.41 ERRSELR_ELI, Error Record Select Register, EL1 
on page B2-361 

ERXADDR EL] 3 c5 0 c4 3 64 B2.42 ERXADDR_ELI, Selected Error Record Address Register, 
ELI on page B2-362 

ERXCTLR_EL1 3 c5 0 c4 1 64 B2.43 ERXCTLR_EL1, Selected Error Record Control Register, 
ELI on page B2-363 

ERXFR_ EL1 3 c5 0 c4 0 64 B2.44 ERXFR_ELI, Selected Error Record Feature Register, EL1 
on page B2-364 

ERXMISCO_EL1 3 c5 0 c5 0 64 B2.45 ERXMISCO_EL1, Selected Error Record Miscellaneous 
Register 0, ELI on page B2-365 

ERXMISC1_EL1 3 c5 0 c5 1 64 B2.46 ERXMISC1_EL1, Selected Error Record Miscellaneous 
Register 1, ELI on page B2-366 

ERXSTATUS _EL1 3 c5 0 c4 2 32 B2.50 ERXSTATUS_EL1, Selected Error Record Primary Status 
Register, ELI on page B2-372 

ESR_EL1 3 c5 0 c2 0 32 B2.51 ESR_EL1, Exception Syndrome Register, EL1 
on page B2-373 

ESR _EL2 3 c5 4 c2 0 32 B2.52 ESR_EL2, Exception Syndrome Register, EL2 
on page B2-374 

ESR_EL3 3 c5 6 c2 0 32 B2.53 ESR_EL3, Exception Syndrome Register, EL3 
on page B2-375 

HACR_EL2 3 cl 4 cl 7 32 B2.54 HACR_EL2, Hyp Auxiliary Configuration Register, EL2 
on page B2-376 

HCR_EL2 3 cl 4 cl 0 64 B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 
on page B2-377 

ID_AFRO EL1 3 c0 0 cl 3 32 B2.65 ID_AFRO_EL1, AArch32 Auxiliary Feature Register 0, 
ELI on page B2-393 
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B2 AArch64 system registers 
B2.2 AArch64 architectural system register summary 


Table B2-1 Registers with implementation defined bit fields (continued) 













































































Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 

ID_DFRO EL1 3 c0 0 cl 2 32 B2.66 ID_DFRO_EL1, AArch32 Debug Feature Register 0, EL1 
on page B2-394 

ID_ISARO_EL1 3 c0 0 c2 0 32 B2.67 ID_ISARO_EL1, AArch32 Instruction Set Attribute 
Register 0, ELI on page B2-396 

ID_ISAR1 EL] 3 c0 0 c2 1 32 B2.68 ID_ISAR1_EL1, AArch32 Instruction Set Attribute 
Register 1, ELI on page B2-398 

ID_ISAR2 EL] 3 c0 0 c2 2 32 B2.69 ID ISAR2_EL1, AArch32 Instruction Set Attribute 
Register 2, ELI on page B2-400 

ID_ISAR3_ EL1 3 c0 0 c2 3 32 B2.70 ID_ISAR3_EL1, AArch32 Instruction Set Attribute 
Register 3, ELI on page B2-402 

ID_ISAR4 EL] 3 c0 0 c2 4 32 B2.71 ID_ISAR4_EL1, AArch32 Instruction Set Attribute 
Register 4, ELI on page B2-404 

ID_ISARS_EL1 3 c0 0 c2 5 32 B2.72 ID_ISAR5_EL1, AArch32 Instruction Set Attribute 
Register 5, ELI on page B2-406 

ID_ISAR6_EL1 3 c0 0 c2 7 32 B2.73 ID_ISAR6_EL1, AArch32 Instruction Set Attribute 
Register 6, ELI on page B2-408 

ID_MMFRO EL1 3 c0 0 cl 4 32 B2.74 ID_MMFRO_EL1, AArch32 Memory Model Feature 
Register 0, ELI on page B2-409 

ID_MMEFRI1 EL1 3 c0 0 cl 5 32 B2.75 ID_MMFRI_EL1, AArch32 Memory Model Feature 
Register 1, ELI on page B2-411 

ID_MMFR2 EL1 3 c0 0 cl 6 32 B2.76 ID_MMFR2_EL1, AArch32 Memory Model Feature 
Register 2, ELI on page B2-413 

ID_MMFR3_ EL1 3 c0 0 cl 7 32 B2.77 ID_MMFR3_EL1, AArch32 Memory Model Feature 
Register 3, ELI on page B2-415 

ID_MMFR4 EL1 3 c0 0 c2 6 32 B2.78 ID_MMFR4_EL1, AArch32 Memory Model Feature 
Register 4, ELI on page B2-417 

ID_PFRO EL1 3 c0 0 cl 0 32 B2.79 ID_PFRO_EL1, AArch32 Processor Feature Register 0, 
ELI on page B2-419 

ID_PFR1 EL1 3 c0 0 cl 1 32 B2.80 ID_PFR1_EL1, AArch32 Processor Feature Register 1, 
ELI on page B2-421 

ID_PFR2 EL1 3 c0 0 c3 4 32 B2.81 ID_PFR2_EL1, AArch32 Processor Feature Register 2, 
ELI on page B2-423 

ID_AA64DFRO EL1 3 c0 0 c5 0 64 B2.57 ID_AA64DFRO_EL1, AArch64 Debug Feature Register 0, 
ELI on page B2-380 

ID_AA64ISARO ELI |3 c0 0 c6 0 64 B2.58 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute 
Register 0, ELI on page B2-382 

ID_AAO4ISARI] ELI] |3 c0 0 c6 1 64 B2.59 ID_AA64ISARI_EL1, AArch64 Instruction Set Attribute 
Register 1, ELI on page B2-384 

ID_AA64MMEFRO ELI | 3 c0 0 c7 0 64 B2.60 ID_AA64MMFRO_EL1, AArch64 Memory Model Feature 
Register 0, ELI on page B2-385 

ID_AA64MMEFRI1 ELI | 3 c0 0 c7 1 64 B2.61 ID_AA64MMFRI1_EL1, AArch64 Memory Model Feature 
Register 1, ELI on page B2-387 
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B2 AArch64 system registers 
B2.2 AArch64 architectural system register summary 


Table B2-1 Registers with implementation defined bit fields (continued) 







































































Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 
ID_AA64MMFR2 EL] |3 c0 0 c7 2 64 B2.62 ID_AA64MMFR2_EL1, AArch64 Memory Model Feature 
Register 2, ELI on page B2-389 
ID_AA64PFRO EL] 3 c0 0 c4 0 64 B2.63 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 
0, ELI on page B2-390 
ID_AA64PFRI EL] 3 c0 0 c4 1 64 B2.64 ID_AA64PFRI_EL1, AArch64 Processor Feature Register 
1, ELI on page B2-392 
IFSR32_EL2 3 c5 4 c0 1 32 B2.82 IFSR32_EL2, Instruction Fault Status Register, EL2 
on page B2-424 
LORC _EL1 3 cl0 |0 c4 3 64 B2.83 LORC_EL1, LORegion Control Register, EL1 
on page B2-426 
LORID_EL1 3 cld |0 c4 d 64 B2.85 LORID_EL1, Limited Order Region Identification 
Register, ELI on page B2-428 
LORN_EL1 3 cl0 |0 c4 2 64 B2.86 LORN_EL1, LORegion Number Register, EL1 
on page B2-429 
MDCR_EL3 3 cl 6 c3 1 32 B2.88 MDCR_EL3, Monitor Debug Configuration Register, EL3 
on page B2-431 
MIDR _EL1 3 c0 0 c0 0 32 B2.89 MIDR_ELI, Main ID Register, EL] on page B2-433 
MPIDR_EL1 3 c0 0 c0 5 64 B2.90 MPIDR_EL1, Multiprocessor Affinity Register, EL1 
on page B2-434 
PAR EL1 3 c7 0 c4 0 64 B2.91 PAR_ELI, Physical Address Register, EL1 on page B2-436 
RVBAR_EL3 3 cl2 |6 c0 1 64 B2.93 RVBAR_EL3, Reset Vector Base Address Register, EL3 
on page B2-438 
REVIDR ELI 3 c0 0 c0 6 32 B2.92 REVIDR_ELI, Revision ID Register, EL1 on page B2-437 
SCTLR_EL1 3 cl 0 c0 0 32 B2.94 SCTLR_EL1, System Control Register, EL1 
on page B2-439 
SCTLR_EL3 3 cl 6 c0 0 32 B2.96 SCTLR_EL3, System Control Register, EL3 
on page B2-441 
TCR_EL1 3 c2 0 c0 2 64 B2.97 TCR_ELI, Translation Control Register, EL1 
on page B2-442 
TCR_EL2 3 c2 4 c0 2 64 B2.98 TCR_EL2, Translation Control Register, EL2 
on page B2-444 
TCR_EL3 3 c2 6 c0 2 64 B2.99 TCR_EL3, Translation Control Register, EL3 
on page B2-448 
TTBRO_EL1 3 c2 0 c0 0 64 B2.100 TTBRO_ELI, Translation Table Base Register 0, EL1 
on page B2-450 
TTBRO_EL2 3 c2 4 c0 0 64 B2.101 TTBRO_EL2, Translation Table Base Register 0, EL2 
on page B2-451 
TTBRO_EL3 3 c2 6 c0 0 64 B2.102 TTBRO_EL3, Translation Table Base Register 0, EL3 
on page B2-452 
TTBR1_EL1 3 c2 0 c0 1 64 B2.103 TTBR1_ELI, Translation Table Base Register 1, EL1 
on page B2-453 
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B2 AArch64 system registers 
B2.2 AArch64 architectural system register summary 


Table B2-1 Registers with implementation defined bit fields (continued) 






























































































































































Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 
TTBR1_EL2 3 c2 4 c0 1 64 B2.104 TTBR1_EL2, Translation Table Base Register 1, EL2 
on page B2-454 
VDISR_EL2 3 cl2 |4 cl 1 64 B2.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, 
EL2 on page B2-455 
VSESR_EL2 3 c5 4 c2 3 64 B2.108 VSESR_EL2, Virtual SError Exception Syndrome 
Register on page B2-460 
VTCR_EL2 3 c2 4 cl 2 32 B2.109 VTCR_EL2, Virtualization Translation Control Register, 
EL2 on page B2-462 
VTTBR_EL2 3 c2 4 cl 0 64 B2.110 VTTBR_EL2, Virtualization Translation Table Base 
Register, EL2 on page B2-463 
Table B2-2 Other architecturally defined registers 
Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 
AFSRO_EL12 3 c5 5 1 0 32 Auxiliary Fault Status Register 0 
AFSR1_EL12 3 c5 5 1 1 32 Auxiliary Fault Status Register 1 
AMAIR_EL12 3 cl0 |5 c3 0 64 Auxiliary Memory Attribute Indirection Register 
CNTFRQ_ ELO 3 cl4 |3 0 0 32; Counter-timer Frequency register 
CNTHCTL_EL2 3 cl4 |4 cl 0 32 Counter-timer Hypervisor Control register 
CNTHP_ CTL _EL2 3 cl4 |4 c2 1 32 Counter-timer Hypervisor Physical Timer Control register 
CNTHP_CVAL EL2 |3 cl4 |4 c2 2 64 Counter-timer Hyp Physical CompareValue register 
CNTHP_TVAL EL2 |3 cl4 |4 c2 0 32 Counter-timer Hyp Physical Timer TimerValue register 
CNTHV_CTL_EL2 3 cl4 |4 c3 1 32 Counter-timer Virtual Timer Control register 
CNTHV_CVAL EL2 |3 cl4 |4 c3 2 64 Counter-timer Virtual Timer Compare Value register 
CNTHV_TVAL _EL2 |3 cl4 |4 c3 0 32 Counter-timer Virtual Timer TimerValue register 
CNTKCTL_EL1 3 cl4 |0 cl 0 32 Counter-timer Kernel Control register 
CNTKCTL_EL12 3 cl4 {5 cl 0 32 Counter-timer Kernel Control register 
CNTP_CTL_ELO 3 cl4 |3 c2 1 32 Counter-timer Physical Timer Control register 
CNTP_CTL_EL02 3 cl4 {5 c2 1 32 Counter-timer Physical Timer Control register 
CNTP_CVAL_ELO 3 cl4 |3 c2 2 64 Counter-timer Physical Timer CompareValue register 
CNTP_CVAL_EL02 |3 cl4 {5 c2 2 64 Counter-timer Physical Timer CompareValue register 
CNTP_TVAL ELO 3 cl4 |3 c2 0 32 Counter-timer Physical Timer TimerValue register 
CNTP_TVAL ELO2 |3 cl4 {5 c2 0 32 Counter-timer Physical Timer TimerValue register 
CNTPCT_ELO 3 cl4 |3 c0 1 64 Counter-timer Physical Count register 
CNTPS_CTL_EL1 3 cl4 |7 c2 1 32 Counter-timer Physical Secure Timer Control register 
CNTPS_CVAL ELI] |3 cl4 |7 c2 2 64 Counter-timer Physical Secure Timer Compare Value register 
CNTPS_TVAL ELI] |3 cl4 |7 c2 0 32 Counter-timer Physical Secure Timer TimerValue register 
CNTV_CTL_ELO 3 cl4 |3 c3 1 32 Counter-timer Virtual Timer Control register 
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B2.2 AArch64 architectural system register summary 


Table B2-2 Other architecturally defined registers (continued) 





























































































































Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 

CNTV_CTL_EL02 3 cl4 |5 c3 1 32 Counter-timer Virtual Timer Control register 
CNTV_CVAL _ELO 3 cl4 |3 c3 2 64 Counter-timer Virtual Timer CompareValue register 
CNTV_CVAL EL02 |3 cl4 {5 c3 2 64 Counter-timer Virtual Timer CompareValue register 
CNTV_TVAL_ELO 3 cl4 |3 c3 0 32 Counter-timer Virtual Timer TimerValue register 
CNTV_TVAL ELO2 |3 cl4 {5 c3 0 32 Counter-timer Virtual Timer TimerValue register 
CNTVCT_ELO 3 cl4 |3 c0 2 64 Counter-timer Virtual Count register 
CNTVOFF_EL2 3 cl4 |4 c0 3 64 Counter-timer Virtual Offset register 
CONTEXTIDR EL! |3 cl3 |0 c0 1 32 Context ID Register (EL1) 
CONTEXTIDR_EL12 | 3 cl3 {5 c0 1 32 Context ID Register (EL12) 
CONTEXTIDR_ EL2 |3 cl3 |4 c0 1 32 Context ID Register (EL2) 

CPACR_EL12 3 cl 5 c0 2 32 Architectural Feature Access Control Register 
CPTR_EL3 3 cl 6 cl 2 32 Architectural Feature Trap Register (EL3) 
DACR32_EL2 3 c3 4 c0 0 32 Domain Access Control Register 

ESR_EL12 3 c5 5 c2 0 32 Exception Syndrome Register (EL12) 

FAR _EL1 3 c6 0 c0 0 64 Fault Address Register (EL1) 

FAR_EL12 3 c6 5 c0 0 64 Fault Address Register (EL12) 

FAR EL2 3 c6 4 c0 0 64 Fault Address Register (EL2) 

FAR_EL3 3 c6 6 c0 0 64 Fault Address Register (EL3) 

FPEXC32_EL2 3 c5 4 c3 0 32 Floating-point Exception Control register 
HPFAR_EL2 3 c6 4 c0 4 64 Hypervisor IPA Fault Address Register 
HSTR_EL2 3 cl 4 cl 3 32 Hypervisor System Trap Register 
ID_AA64AFRO ELI {3 c0 0 c5 4 64 AArch64 Auxiliary Feature Register 0 
ID_AA64AFR1 ELI |3 c0 0 c5 5 64 AArch64 Auxiliary Feature Register 1 
ID_AA64DFR1_EL1 |3 c0 0 c5 1 64 AArch64 Debug Feature Register 1 

ISR_EL1 3 cl2 |0 cl 0 32 Interrupt Status Register 

LOREA ELI 3 cl0 |0 c4 1 64 LORegion End Address Register 

LORSA_EL1 3 cl0 |0 c4 0 64 LORegion Start Address Register 

MAIR _EL1 3 cl0 |0 c2 0 64 Memory Attribute Indirection Register (EL1) 
MAIR EL12 3 cl0 {5 c2 0 64 Memory Attribute Indirection Register (EL12) 
MAIR _EL2 3 clO |4 c2 0 64 Memory Attribute Indirection Register (EL2) 
MAIR EL3 3 clO |6 c2 0 64 Memory Attribute Indirection Register (EL3) 
MDCR_EL2 3 cl 4 cl 1 32 Monitor Debug Configuration Register 

MVFRO EL1 3 c0 0 c3 0 32 AArch32 Media and VFP Feature Register 0 
MVFRI_ EL1 3 c0 0 c3 1 32 AArch32 Media and VFP Feature Register 1 
MVFR2_EL1 3 c0 0 c3 2 32 AArch32 Media and VFP Feature Register 2 
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Table B2-2 Other architecturally defined registers (continued) 
















































































Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 

RMR_EL3 3 cl2 |6 c0 2 32 Reset Management Register 

SCR_EL3 3 cl 6 cl 0 32 Secure Configuration Register 

SCTLR_EL12 3 cl > c0 0 32 System Control Register (EL12) 
SCTLR_EL2 3 cl 4 c0 0 32 System Control Register (EL2) 
SDER32_EL3 3 cl 6 cl 1 32 AArch32 Secure Debug Enable Register 
TCR_EL12 3 c2 5 c0 2 64 Translation Control Register (EL12) 
TPIDR_ELO 3 cl3 |3 c0 2 64 ELO Read/Write Software Thread ID Register 
TPIDR_ EL1 3 cl3 |0 c0 4 64 EL1 Software Thread ID Register 

TPIDR_ EL2 3 cl3 |4 c0 2 64 EL2 Software Thread ID Register 
TPIDR_EL3 3 cl3 |6 c0 2 64 EL3 Software Thread ID Register 

TPIDRRO ELO 3 cl3 13 c0 3 64 ELO Read-Only Software Thread ID Register 
TTBRO EL12 3 c2 5 c0 0 64 Translation Table Base Register 0 (EL12) 
TTBRI1_EL12 3 c2 5 c0 1 64 Translation Table Base Register 1 (EL12) 
VBAR_EL1 3 cl2 |0 c0 0 64 Vector Base Address Register (EL1) 
VBAR_EL12 3 cl2 |5 c0 0 64 Vector Base Address Register (EL12) 
VBAR_EL2 3 cl2 |4 c0 0 64 Vector Base Address Register (EL2) 
VBAR_EL3 3 cl2 |6 c0 0 64 Vector Base Address Register (EL3) 
VMPIDR_ EL2 3 c0 4 c0 5 64 Virtualization Multiprocessor ID Register 
VPIDR_EL2 3 c0 4 c0 0 32 Virtualization Core ID Register 
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B2.3 AArch64 implementation defined register summary 




































































B2.3 AArch64 implementation defined register summary 
This section describes the AArch64 registers in the core that are implementation defined. 
The following tables lists the AArch 64 implementation defined registers, sorted by opcode. 
Table B2-3 AArch64 implementation defined registers 

Name Op0 | CRn | Op1 | CRm | Op2 | Width | Description 

AIDR_EL1 3 c0 1 c0 7 32 B2.14 AIDR_ELI, Auxiliary ID Register, EL1 on page B2-315 

ATCR_EL1 3 clS |0 c7 0 64 B2.18 ATCR_ELI, Auxiliary Translation Control Register, EL1 
on page B2-319 

ATCR_EL2 3 clS |4 c7 0 64 B2.20 ATCR_EL2, Auxiliary Translation Control Register, EL2 
on page B2-322 

ATCR_EL12 3 clS |5 c7 0 - B2.19 ATCR_EL12, Alias to Auxiliary Translation Control 
Register EL1 on page B2-321 

ATCR_EL3 3 clS |6 c7 0 64 B2.21 ATCR_EL3, Auxiliary Translation Control Register, EL3 
on page B2-324 

AVTCR_EL2 3 clS |4 c7 1 64 B2.22 AVTCR_EL2, Auxiliary Virtualized Translation Control 
Register, EL2 on page B2-326 

CCSIDR_EL1 3 c0 1 c0 0 32 B2.23 CCSIDR_EL1, Cache Size ID Register, ELI on page B2-328 

CLIDR_EL1 3 c0 1 c0 1 64 B2.24 CLIDR_EL1, Cache Level ID Register, EL] on page B2-331 

CPUACTLR_EL1 3 cl5 |0 cl 0 64 B2.28 CPUACTLR_EL1, CPU Auxiliary Control Register, EL1 
on page B2-336 

CPUCFR_EL1 3 clS |0 c0 0 32 B2.29 CPUCFR_EL1, CPU Configuration Register, EL] 
on page B2-338 

CPUECTLR_EL1 3 cl5 |0 cl 4 64 B2.30 CPUECTLR_EL1, CPU Extended Control Register, EL1 
on page B2-340 

CPUPCR_EL3 3 15 6 c8 1 64 B2.31 CPUPCR_EL3, CPU Private Control Register, EL3 
on page B2-343 

CPUPMR_EL3 3 cl5 |6 c8 3 64 B2.32 CPUPMR_EL3, CPU Private Mask Register, EL3 
on page B2-345 

CPUPOR_EL3 3 clS |6 c8 2 64 B2.33 CPUPOR_EL3, CPU Private Operation Register, EL3 
on page B2-347 

CPUPSELR_EL3 3 clS |6 c8 0 32 B2.34 CPUPSELR_EL3, CPU Private Selection Register, EL3 
on page B2-349 

CPUPWRCTLR_ EL! | 3 cl5 |0 c2 7 32 B2.35 CPUPWRCTLR_ELI, Power Control Register, EL1 
on page B2-351 

ERRIDR_EL1 3 c5 0 c3 0 32 B2.40 ERRIDR_ELI, Error ID Register, EL] on page B2-360 

ERXPFGCDNR EL] | 3 cl5 |0 c2 2 32 B2.47 ERXPFGCDNR_ELI, Selected Error Pseudo Fault 
Generation Count Down Register, EL1 on page B2-367 

ERXPFGCTLR_EL1 |3 cl5 |0 c2 1 32 B2.48 ERXPFGCTLR_EL1I, Selected Error Pseudo Fault 
Generation Control Register, EL1 on page B2-369 

ERXPFGFR_EL1 3 clS |0 c2 0 32 B2.49 ERXPFGFR_EL1, Selected Pseudo Fault Generation 


























Feature Register, EL1 on page B2-371 








The following table shows the 32-bit wide implementation defined Cluster registers. Details of these 
registers can be found in Arm® DynamIQ™ Shared Unit Technical Reference Manual 
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B2.3 AArch64 implementation defined register summary 


Table B2-4 Cluster registers 

























































































Name Op0|}CRnJ|op1 |CRm | op2 | Width Description 
CLUSTERCFR_EL1 3 clS |0 c3 0 32-bit Cluster configuration register. 
CLUSTERIDR _EL1 3 clS |0 c3 1 32-bit Cluster main revision ID. 
CLUSTEREVIDR_ EL1 3 cl5 |0 c3 2 32-bit Cluster ECO ID. 
CLUSTERACTLR_EL1 3 clS |0 c3 3 32-bit Cluster auxiliary control register. 
CLUSTERECTLR_EL1 3 clS |0 c3 4 32-bit Cluster extended control register. 
CLUSTERPWRCTLR_ EL1 3 clS |0 c3 5 32-bit Cluster power control register. 
CLUSTERPWRDN ELI 3 cl5 |0 c3 6 32-bit Cluster power down register. 
CLUSTERPWRSTAT_EL1 3 cl5 |0 c3 of 32-bit Cluster power status register. 
CLUSTERTHREADSID EL1 3 clS |0 c4 0 32-bit Cluster thread scheme ID register. 
CLUSTERACPSID EL1 3 clS |0 c4 1 32-bit Cluster ACP scheme ID register. 
CLUSTERSTASHSID EL1 3 clS |0 c4 2: 32-bit Cluster stash scheme ID register. 
CLUSTERPARTCR_EL1 3 clS |0 c4 3 32-bit Cluster partition control register. 
CLUSTERBUSQOS _EL1 3 cl5 |0 c4 4 32-bit Cluster bus QoS control register. 
CLUSTERL3HIT_EL1 3 clS |0 c4 5 32-bit Cluster L3 hit counter register. 
CLUSTERL3MISS_EL1 3 clS |0 c4 6 32-bit Cluster L3 miss counter register. 
CLUSTERTHREADSIDOVR ELI | 3 clS |0 c4 7 32-bit Cluster thread scheme ID override register. 
CLUSTERPM* _ELx 3 cl5 |0or6]|c5-c6 | 0-7 | 32-bit or 64-bit | Cluster PMU registers 
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B2.4 AArch64 registers by functional group 


B2.4 AArch64 registers by functional group 


This section identifies the AArch64 registers by their functional groups and applies to the registers in the 


core that are implementation defined or have micro-architectural bit fields. 


Reset values are provided for these registers. 


Identification registers 





























Name Type | Reset Description 
AIDR_EL1 RO | exeeeee00e B2.14 AIDR_ELI, Auxiliary ID Register, EL1 on page B2-315 
CCSIDR__EL1 RO |. B2.23 CCSIDR_EL1, Cache Size ID Register, ELI on page B2-328 
CLIDR_EL1 RO | UNK B2.24 CLIDR_ELI, Cache Level ID Register, EL1 on page B2-331 
Unknown: [31:30], [25:24], If the L2 cache is not implemented, the value is @x892000@3. 
[22:21], 8, 5 
‘bl: [1:0] 
'bO: [29:26], 23, [20:9], [7:6], 
[4:2] 
CSSELR_ELI RW_ | exeeeee09e B2.36 CSSELR_ELI, Cache Size Selection Register, EL1 
on page B2-354 
CTR_ELO RO | @x84448004 B2.37 CTR_ELO, Cache Type Register, ELO on page B2-355 
DCZID_ELO RO |- B2.38 DCZID_ELO, Data Cache Zero ID Register, ELO 
on page B2-357 
ERRIDR_EL1 RO |- B2.40 ERRIDR_ELI, Error ID Register, EL1 on page B2-360 
ID_AA64DFRO_ ELI] |RO | @xe@@@0000010305408 B2.57 ID_AA64DFRO_EL1, AArch64 Debug Feature Register 0, 


ELI on page B2-380 





ID_AA64ISARO_ELI |RO- | UNK B2.58 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute 


Uiikearwiit12'8:5 Register 0, ELI on page B2-382 


If the Cryptographic extensions are not implemented or disabled 





'bl: 28, 21, 16 
these fields will read . 
'bO: [64:29], [27:22], [20:17], 
[15:13], [11:9], [7:6], [4:0] 
ID_AAG4ISARI_EL1 |RO_ | e@xeeeeeeeeee100001 B2.59 ID_AA64ISARI_EL1, AArch64 Instruction Set Attribute 


Register 1, EL1 on page B2-384 





ID_AA64MMFRO_EL1|RO | @xe@@@0000000101122 B2.60 ID_AA64MMFRO_ELI, AArch64 Memory Model Feature 


Register 0, ELI on page B2-385 





ID_AA64MMFR1_EL1|RO | @x@@e@0000010212122 B2.61 ID_AA64MMFRI1_ELI, AArch64 Memory Model Feature 


Register 1, ELI on page B2-387 











ID_AA64MMFR2_ EL1|RO | @xe@9e000000001011 B2.62 ID_AA64MMFR2_ELI, AArch64 Memory Model Feature 


Register 2, ELI on page B2-389 
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Name 


Type 


Reset 


Description 





ID_AA64PFRO_ EL] 


RO 


UNK 
Unknown: 24, [23:20], [19:16] 
‘pl: 28, 13, 9, 5, 1 


'bO: [63:29], [27:25], [15:14], 
[12:10], [8:6], [4:2], 0 


B2.63 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 
0, ELI on page B2-390 


If Advanced-SIMD/FP has been configured then [23:20] and 
[19:16] report 6001, otherwise they report 1111. 


If the GICv4 interface is disabled (GICCDISABLE is high) [24] 
will read @, otherwise it will read 1. 





















































ID_AA64PFRI_ ELI |RO | @xeeeeeeeeeeeeeele B2.64 ID_AA64PFRI_EL1, AArch64 Processor Feature Register 
1, ELI on page B2-392 

ID_AFRO_EL1 RO | exeeeeeeee B2.65 ID_AFRO_ELI, AArch32 Auxiliary Feature Register 0, ELI 
on page B2-393 

ID_DFRO_EL1 RO | @xe4010088 B2.66 ID_DFRO_EL1, AArch32 Debug Feature Register 0, EL1 
on page B2-394 
Bits [19:16] are @x1 if ETM is implemented, and @x@ otherwise. 

ID_ISARO_EL1 RO | @xe2101110 B2.67 ID _ISARO_EL1, AArch32 Instruction Set Attribute Register 
0, ELJ on page B2-396 

ID_ISARI_ ELI RO | @x13112111 B2.68 ID ISARI_EL1, AArch32 Instruction Set Attribute Register 
1, ELI on page B2-398 

ID_ISAR2 EL] RO | @x21232042 B2.69 ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 
2, ELI on page B2-400 

ID_ISAR3_EL1 RO | @x@1112131 B2.70 ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 
3, ELI on page B2-402 

ID_ISAR4 EL] RO | @xeee11142 B2.71 ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 
4, EL1 on page B2-404 

ID_ISAR5_EL1 RO | @xe@e11121 B2.72 ID_ISARS_ELI, AArch32 Instruction Set Attribute Register 
J, EL1 on page B2-406 
ID_ISARS has the value @x@0010001 if the Cryptographic 
Extension is not implemented and enabled. 

ID_ISAR6_EL1 RO | exeeeeee10 B2.73 ID_ISAR6 ELI, AArch32 Instruction Set Attribute Register 
6, EL1 on page B2-408 

ID_MMFRO_EL1 RO | @x10201105 B2.74 ID_MMFRO_ELI, AArch32 Memory Model Feature 
Register 0, ELI on page B2-409 

ID_MMFR1_EL1 RO | ex4eeee000 B2.75 ID_MMFRI1_EL1, AArch32 Memory Model Feature 
Register 1, ELI on page B2-411 

ID_MMFR2_EL1 RO | @xe1260000 B2.76 ID MMFR2_ ELI, AArch32 Memory Model Feature 
Register 2, EL1 on page B2-413 

ID_MMFR3_EL1 RO | @x@2122211 B2.77 ID_MMFR3_ ELI, AArch32 Memory Model Feature 











Register 3, ELI on page B2-415 
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B2.4 AArch64 registers by functional group 


(continued) 





Name 


Type 


Reset 


Description 





ID_MMFR4 ELI 


RO | @xee@e21112 


Register 4, ELI on page B2-417 


B2.78 ID_MMFR4_EL1, AArch32 Memory Model Feature 
































ID_PFRO_EL1 RO | e@xeee00131 B2.79 ID_PFRO_EL1, AArch32 Processor Feature Register 0, 
ELI on page B2-419 
ID_PFRI_EL1 RO | @x10011011 B2.80 ID_PFRI_EL1, AArch32 Processor Feature Register 1, 
ELI on page B2-421 
Bits [31:28] are @x1 if the GIC CPU interface is implemented and 
enabled, and @x@ otherwise. 
ID_PFR2_EL1 RO | exeee0eee11 B2.81 ID_PFR2_EL1, AArch32 Processor Feature Register 2, 
ELI on page B2-423 
LORID_EL1 RO | exeeeeeeeee0040004 B2.85 LORID_ELI, Limited Order Region Identification Register, 
ELI on page B2-428 
MIDR_EL1 RO | @x412FDe5e B2.89 MIDR_EL1, Main ID Register, ELI on page B2-433 
MPIDR_EL1 RO | Unknown: [29:25], [23:16], B2.90 MPIDR_ELI, Multiprocessor Affinity Register, ELI 
[10:8] on page B2-434 
'bl: 31, 24 
'bO: [15:11], [7:0] 
REVIDR_EL1 RO | exeeeeee00 B2.92 REVIDR_ELI, Revision ID Register, ELI on page B2-437 
VMPIDR_EL2 RW |- Virtualization Multiprocessor ID Register EL2 
The reset value is the value of MPIDR_EL1. 
VPIDR_EL2 RW |- 








Virtualization Core ID Register EL2 


The reset value is the value of MIDR_EL1. 











Other system control registers 


























Name Type | Description 

ACTLR_EL1|RW_ | 82.5 ACTLR_ELI, Auxiliary Control Register, EL1 on page B2-304 

ACTLR_EL2|RW | 82.6 ACTLR_EL2, Auxiliary Control Register, EL2 on page B2-305 

ACTLR_EL3|RW_ | 82.7 ACTLR_EL3, Auxiliary Control Register, EL3 on page B2-307 

CPACR_EL] |RW | 22.25 CPACR_EL1, Architectural Feature Access Control Register, EL1 on page B2-333 
SCTLR_EL] |RW | 32.94 SCTLR_ELI, System Control Register, ELI on page B2-439 

SCTLR_EL3 | RW 








B2.96 SCTLR_EL3, System Control Register, EL3 on page B2-441 
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B2.4 AArch64 registers by functional group 


Reliability, Availability, Serviceability (RAS) registers 


















































Name Type | Description 
DISR_EL1 RW | 82.39 DISR_EL1, Deferred Interrupt Status Register, EL] on page B2-358 
ERRIDR_EL1 RW | 82.40 ERRIDR_ELI, Error ID Register, ELI on page B2-360 
ERRSELR_EL1 RW | 82.41 ERRSELR_ELI, Error Record Select Register, ELI on page B2-361 
ERXADDR ELI RW | 82.42 ERXADDR ELI, Selected Error Record Address Register, EL1 on page B2-362 
ERXCTLR_EL1 RW | 82.43 ERXCTLR_ELI, Selected Error Record Control Register, ELI on page B2-363 
ERXFR_EL1 RO | 32.44 ERXFR_EL1, Selected Error Record Feature Register, EL1 on page B2-364 
ERXMISCO_EL1 RW | 82.45 ERXMISCO0_EL1, Selected Error Record Miscellaneous Register 0, EL] on page B2-365 
ERXMISC1_EL1 RW | B2.46 ERXMISCI _EL1, Selected Error Record Miscellaneous Register 1, EL] on page B2-366 
ERXSTATUS_ ELI RW | B2.50 ERXSTAT: US_EL1, Selected Error Record Primary Status Register, EL1 on page B2-372 
ERXPFGCDNR_EL1|RW | 82.47 ERYPFGCDNR_ELI, Selected Error Pseudo Fault Generation Count Down Register, ELI 
on page B2-367 
ERXPFCTLR_ELI |RW | 82.48 ERYPFGCTLR_ELI, Selected Error Pseudo Fault Generation Control Register, EL1 
on page B2-369 
ERXPFGFR_EL1 RO | 82.49 ERXPF GFR_EL1, Selected Pseudo Fault Generation Feature Register, EL1 on page B2-371 
HCR_EL2 RW | B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 on page B2-377 
VDISR_EL2 RW | 82.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 on page B2-455 
VSESR_EL2 RW | 82.108 VSESR_EL2, Virtual SError Exception Syndrome Register on page B2-460 














Virtual Memory control registers 






































Name Type | Description 

AMAIR_EL1|RW_ | 32.15 AMAIR_ELI, Auxiliary Memory Attribute Indirection Register, ELI on page B2-316 
AMAIR_EL2|RW_ | 32.16 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register, EL2 on page B2-317 
AMAIR_EL3)RW_ | 32.17 AMAIR_EL3, Auxiliary Memory Attribute Indirection Register, EL3 on page B2-318 
ATCR_ELI |RW | 32718 ATCR_ELI, Auxiliary Translation Control Register, ELI on page B2-319 
ATCR_EL2 |RW | 32.20 471 CR_EL2, Auxiliary Translation Control Register, EL2 on page B2-322 
ATCR_EL12 | - B2.19 ATCR_EL12, Alias to Auxiliary Translation Control Register EL1 on page B2-321 
ATCR_EL3) |RW | 2.27 ATI CR_EL3, Auxiliary Translation Control Register, EL3 on page B2-324 
AVTCR_EL2 |RW | 32.22 AvT CR_EL2, Auxiliary Virtualized Translation Control Register, EL2 on page B2-326 
LORC_EL1 |RW_ | 32.83 LORC_ELI, LORegion Control Register, EL1 on page B2-426 

LOREA_EL1) RW LORegion End Address Register EL1 
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Name Type | Description 





LORID_ELI |RO | 22.85 LORID_ELI, Limited Order Region Identification Register, EL] on page B2-428 





LORN_ELI |RW_ | 82.86 LORN_EL1, LORegion Number Register, EL1 on page B2-429 





LORSA_ELI | RW LORegion Start Address Register EL1 





TCR_EL1 = |RW_ | 82.97 TCR_ELI, Translation Control Register, ELI on page B2-442 





TCR_EL2 RW | 82.98 T CR_EL2, Translation Control Register, EL2 on page B2-444 





TCR_EL3 RW | 82.99 T CR_EL3, Translation Control Register, EL3 on page B2-448 





TTBRO_ELI |RW_ | 82.100 TTBRO_ELI, Translation Table Base Register 0, ELI on page B2-450 





TTBRO_EL2 |RW_ | 82.101 TTBRO_EL2, Translation Table Base Register 0, EL2 on page B2-451 





TTBRO_EL3 |RW_ | 82.102 TTBRO_EL3, Translation Table Base Register 0, EL3 on page B2-452 





TTBRI_ELI |RW | 82.103 TTBRI_ELI, Translation Table Base Register 1, ELI on page B2-453 





TTBR1_EL2 |RW | 82.104 TTBR1_EL2, Translation Table Base Register 1, EL2 on page B2-454 





VTTBR_EL2 |RW | 32.770 VTT. BR_EL2, Virtualization Translation Table Base Register, EL2 on page B2-463 

















Virtualization registers 





Name Type | Description 





ACTLR_EL2 |RW | 32.6 ACTLR_EL2, Auxiliary Control Register, EL2 on page B2-305 





AFSRO_EL2 |RW_ | 32.9 4FSRO_EL2, Auxiliary Fault Status Register 0, EL2 on page B2-310 





AFSRI_EL2 |RW_ | 82 12 AFSRI_EL2, Auxiliary Fault Status Register 1, EL2 on page B2-313 





AMAIR EL2 |RW | 22.16 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register, EL2 on page B2-317 





CPTR_EL2 RW | 82.26 CPTR_EL2, Architectural Feature Trap Register, EL2 on page B2-334 





ESR_EL2 RW | 82.52 ESR_EL2, Exception Syndrome Register, EL2 on page B2-374 





HACR_EL2) |RW_ | 82.54 HACR_EL2, Hyp Auxiliary Configuration Register, EL2 on page B2-376 





HCR_EL2 RW | B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 on page B2-377 





HPFAR_EL2 |RW_ | Hypervisor IPA Fault Address Register EL2 





TCR_EL2 RW | B2.98 TCR_EL2, Translation Control Register, EL2 on page B2-444 





VMPIDR_EL2|RW_ | Virtualization Multiprocessor ID Register EL2 





VPIDR_EL2 |RW_ | Virtualization Core ID Register EL2 





VSESR_EL2 |RW_ | 82.108 VSESR_EL2, Virtual SError Exception Syndrome Register on page B2-460 
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Name 


Type 


Description 





VTCR_EL2 RW 


B2.109 VTCR_EL2, Virtualization Translation Control Register, EL2 on page B2-462 








VTTBR_EL2 | RW 





B2.110 VITBR_EL2, Virtualization Translation Table Base Register, EL2 on page B2-463 











Exception and fault handling registers 


Implementation defined registers 















































Name Type | Description 

AFSRO_ELI |RW | 82.8 AFSRO_ELI, Auxiliary Fault Status Register 0, EL] on page B2-309 
AFSRO_EL2 |RW_ | 32.9 AFSRO_EL2, Auxiliary Fault Status Register 0, EL2 on page B2-310 
AFSRO_EL3 |RW | 32.10 AFSRO_EL3, Auxiliary Fault Status Register 0, EL3 on page B2-311 
AFSRI_ELI |RW | 82.1] AFSRI_ELI, Auxiliary Fault Status Register 1, EL1 on page B2-312 
AFSRI_EL2 |RW | 82.12 AFSRI_EL2, Auxiliary Fault Status Register 1, EL2 on page B2-313 
AFSR1_EL3 |RW | 82.13 AFSRI_EL3, Auxiliary Fault Status Register 1, EL3 on page B2-314 
DISR_EL] |RW | 2239 DISR_EL1, Deferred Interrupt Status Register, EL] on page B2-358 
ESR_ELI RW | B2.51 ESR_EL1, Exception Syndrome Register, ELI on page B2-373 

ESR_EL2 RW | B2.52 ESR_EL2, Exception Syndrome Register, EL2 on page B2-374 

ESR_EL3 RW | B2.53 ESR_EL3, Exception Syndrome Register, EL3 on page B2-375 
HPFAR_EL2 | RW Hypervisor IPA Fault Address Register EL2 

IFSR32_EL2|RW_ | 82.82 IFSR32_EL2, Instruction Fault Status Register, EL2 on page B2-424 
VDISR_EL2 |RW | 32.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 on page B2-455 
VSESR_EL2 |RW | 82.108 VSESR_EL2, Virtual SError Exception Syndrome Register on page B2-460 















































Name Type | Description 

ATCR_EL1 RW_ | B2.18 ATCR_EL1, Auxiliary Translation Control Register, EL] on page B2-319. 
ATCR_EL12 RW_ | B2.19 ATCR_EL12, Alias to Auxiliary Translation Control Register EL1 on page B2-321. 
ATCR_EL2 RW_ | B2.20 ATCR_EL2, Auxiliary Translation Control Register, EL2 on page B2-322. 

ATCR_EL3 RW_ | B2.21 ATCR_EL3, Auxiliary Translation Control Register, EL3 on page B2-324. 
AVTCR_EL2 RW_ | B2.22 AVTCR_EL2, Auxiliary Virtualized Translation Control Register, EL2 on page B2-326. 
CPUACTLR_ELI RW | B2.28 CPUACTLR_EL1, CPU Auxiliary Control Register, ELI on page B2-336 
CPUCFR_EL1 RO | B2.29 CPUCFR_ELI, CPU Configuration Register, EL1 on page B2-338 

CPUECTLR_EL1 RW | B2.30 CPUECTLR_EL1, CPU Extended Control Register, ELI on page B2-340 
CPUPCR_EL3 RW_ | B2.31 CPUPCR_EL3, CPU Private Control Register, EL3 on page B2-343 

















100442 _0200_00_en 


Copyright © 2016-2018 Arm Limited or its affiliates. All rights B2-301 


reserved. 
Non-Confidential 


B2 AArch64 system registers 


B2.4 AArch64 registers by functional group 


(continued) 





























Name Type | Description 
CPUPMR_EL3 RW_ | B2.32 CPUPMR_EL3, CPU Private Mask Register, EL3 on page B2-345 
CPUPOR_EL3 RW_ | 82.33 CPUPOR_EL3, CPU Private Operation Register, EL3 on page B2-347 
CPUPSELR_EL3 RW_ | B2.34 CPUPSELR_EL3, CPU Private Selection Register, EL3 on page B2-349 
CPUPWRCTLR_ELI|RW | 82.35 CPUPWRCTLR_ELI, Power Control Register, ELI on page B2-351 
ERXPFGCDNR_EL1|RW_ | 82.47 ERXPFGCDNR_ELI, Selected Error Pseudo Fault Generation Count Down Register, ELI 
on page B2-367 
ERXPFGCTLR_EL1 |RW_ | 82.48 ERXPFGCTLR_ELI, Selected Error Pseudo Fault Generation Control Register, ELI 
on page B2-369 
ERXPFGFR_EL1 RW | 82.49 ERXPFGFR_EL1, Selected Pseudo Fault Generation Feature Register, ELI on page B2-371 














The following table shows the 32-bit wide implementation defined Cluster registers. Details of these 
registers can be found in Arm® DynamIQ™ Shared Unit Technical Reference Manual 


Table B2-5 Cluster registers 































































































Name Copro | CRn | Opc1 | CRm | Opc2 | Width Description 
CLUSTERCFR_EL1 3 clS |0 c3 0 32-bit Cluster configuration register. 
CLUSTERIDR_ ELI 3 cl5 |0 c3 1 32-bit Cluster main revision ID. 
CLUSTEREVIDR_ EL1 3 cl5 |0 c3 2 32-bit Cluster ECO ID. 
CLUSTERACTLR_EL1 3 clS |0 c3 3 32-bit Cluster auxiliary control register. 
CLUSTERECTLR_EL1 3 clS |0 c3 4 32-bit Cluster extended control register. 
CLUSTERPWRCTLR ELI /|3 clS |0 c3 5 32-bit Cluster power control register. 
CLUSTERPWRDN EL1 3 cl5 |0 c3 6 32-bit Cluster power down register. 
CLUSTERPWRSTAT._EL1 3 cl5 |0 c3 7 32-bit Cluster power status register. 
CLUSTERTHREADSID EL] | 3 clS |0 c4 0 32-bit Cluster thread scheme ID register. 
CLUSTERACPSID EL1 3 clS |0 c4 1 32-bit Cluster ACP scheme ID register. 
CLUSTERSTASHSID EL1  |3 clS |0 c4 2 32-bit Cluster stash scheme ID register. 
CLUSTERPARTCR_EL1 3 clS |0 c4 3 32-bit Cluster partition control register. 
CLUSTERBUSQOS EL1 3 cl5 |0 c4 4 32-bit Cluster bus QoS control register. 
CLUSTERL3HIT_EL1 3 clS |0 c4 5 32-bit Cluster L3 hit counter register. 
CLUSTERL3MISS_EL1 3 clS |0 c4 6 32-bit Cluster L3 miss counter register. 
CLUSTERPM* ELx 3 cl5 | 0 or6 | c5-c6 | 0-7 32-bit or 64-bit | Cluster PMU registers 
Security 

Name Type | Description 

ACTLR_EL3 |RW | 82.7 ACTLR_EL3, Auxiliary Control Register, EL3 on page B2-307 

AFSRO_EL3 | RW 








B2.10 AFSRO_EL3, Auxiliary Fault Status Register 0, EL3 on page B2-311 
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Name Type | Description 





AFSRI_EL3 |RW | 82 13 AFSRI_EL3, Auxiliary Fault Status Register 1, EL3 on page B2-314 





AMAIR_EL3)RW | 82.17 AMAIR_EL3, Auxiliary Memory Attribute Indirection Register, EL3 on page B2-318 





CPTR_EL3 | RW | 82.27 CPTR_EL3, Architectural Feature Trap Register, EL3 on page B2-335 





MDCR_EL3 |RW_ | 82.88 MDCR_EL3, Monitor Debug Configuration Register, EL3 on page B2-431 














Reset management registers 





Name Type | Description 








RVBAR_EL3)/RW_ | 32.93 RVBAR_EL3, Reset Vector Base Address Register, EL3 on page B2-438 














Address registers 





Name Type | Description 








PAR_EL1|RW | 32.91 PAR ELI, Physical Address Register, ELI on page B2-436 
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B2 AArch64 system registers 
B2.5 ACTLR_EL1, Auxiliary Control Register, EL1 


B2.5 ACTLR_EL41, Auxiliary Control Register, EL1 


ACTLR_ELI provides IMPLEMENTATION DEFINED configuration and control options for execution at EL1 
and ELO. 


Bit field descriptions 
ACTLR_ELI is a 64-bit register, and is part of: 


¢ The Other system control registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


63 0 


PO 


RESO 


Figure B2-1 ACTLR_EL1 bit assignments 
RESO, [63:0] 
RESO Reserved. 


Configurations 


AArch64 System register ACTLR_EL1 bits [31:0] are architecturally mapped to AArch32 
System register ACTLR(NS). See B/.5 ACTLR, Auxiliary Control Register on page B1-133. 


AArch64 System register ACTLR_EL1 bits [63:32] are architecturally mapped to AArch32 
System register ACTLR2(S). See B/.6 ACTLR2, Auxiliary Control Register 2 on page B1-135. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.6 ACTLR_EL2, Auxiliary Control Register, EL2 


B2.6 ACTLR_EL42, Auxiliary Control Register, EL2 


The ACTLR_EL2 provides IMPLEMENTATION DEFINED configuration and control options for EL2. 


Bit field descriptions 

ACTLR_EL2 is a 64-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Other system control registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 











63 131211109 8765 4 210 
CLUSTERPMUEN —! 
SMEN 
TSIDEN 
PWREN 
ERXPFGEN 
ECTLREN —4 
ACTLREN 
RESO 


Figure B2-2 ACTLR_EL2 bit assignments 
RESO, [63:13] 


RESO Reserved. 


CLUSTERPMUEN, [12] 
Performance Management Registers enable. The possible values are: 


7) CLUSTERPM* registers are not write-accessible from a lower Exception level. This is 
the reset value. 


1 CLUSTERPM* registers are write-accessible from EL1 Non-secure if they are write- 
accessible from EL2. 


SMEN, [11] 
Scheme Management Registers enable. The possible values are: 


7) Registers CLUSTERACPSID, CLUSTERSTASHSID, CLUSTERPARTCR, 
CLUSTERBUSQOS, and CLUSTERTHREADSIDOVR are not write-accessible from 
EL1 Non-secure. This is the reset value. 


1 Registers CLUSTERACPSID, CLUSTERSTASHSID, CLUSTERPARTCR, 
CLUSTERBUSQOS, and CLUSTERTHREADSIDOVR are write-accessible from 
EL1 Non-secure if they are write-accessible from EL2. 


TSIDEN, [10] 
Thread Scheme ID Register enable. The possible values are: 





i) Register CLUSTERTHREADSID is not write-accessible from EL1 Non-secure. This 
is the reset value. 
1 Register CLUSTERTHREADSID is write-accessible from EL1 Non-secure if they are 
write-accessible from EL2. 
RESO, [9:8] 
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RESO 


PWREN, [7] 


B2 AArch64 system registers 
B2.6 ACTLR_EL2, Auxiliary Control Register, EL2 


Reserved. 


Power Control Registers enable. The possible values are: 


2) 


RESO, [6] 


RESO 


Registers CPUPWRCTLR, CLUSTERPWRCTLR, CLUSTERPWRDN, 
CLUSTERPWRSTAT, CLUSTERL3HIT and CLUSTERL3MISS are not write- 
accessible from EL1 Non-secure. This is the reset value. 


Registers CPUPWRCTLR, CLUSTERPWRCTLR, CLUSTERPWRDN, 
CLUSTERPWRSTAT, CLUSTERL3HIT and CLUSTERL3MISS are write-accessible 
from EL1 Non-secure if they are write-accessible from EL2. 


Reserved. 


ERXPFGEN, [5] 


Error Record Registers enable. The possible values are: 


Q 
1 


RESO, [4:2] 


RESO 


ECTLREN, [1] 


ERXPFG* are not write-accessible from EL1 Non-secure. This is the reset value. 


ERXPFG* are write-accessible from EL1 Non-secure if they are write-accessible from 
EL2. 


Reserved. 


Extended Control Registers enable. The possible values are: 


2) 


ACTLREN, [0] 


CPUECTLR and CLUSTERECTLR are not write-accessible from EL1 Non-secure. 
This is the reset value. 


CPUECTLR and CLUSTERECTLR are write-accessible from EL1 Non-secure if they 
are write-accessible from EL2. 


Auxiliary Control Registers enable. The possible values are: 


2) 


Configurations 


CPUACTLR and CLUSTERACTLR are not write-accessible from EL1 Non-secure. 
This is the reset value. 


CPUACTLR and CLUSTERACTLR are write-accessible from EL1 Non-secure if 
they are write-accessible from EL2. 


ACTLR_EL2 bits [31:0] are architecturally mapped to the AArch32 HACTLR register. See 
B148 HACTLR, Hyp Auxiliary Control Register on page B1-200. 


ACTLR_EL2 bits [63:32] are architecturally mapped to the AArch32 HACTLR2 register. See 
B1.49 HACTLR2, Hyp Auxiliary Control Register 2 on page B1-202. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 


B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 


The ACTLR_EL3 provides IMPLEMENTATION DEFINED configuration and control options for EL3. 


Bit field descriptions 

ACTLR_EL3 is a 64-bit register, and is part of: 

¢ The Other system control registers functional group. 
¢ The Security registers functional group. 

¢ The IMPLEMENTATION DEFINED functional group. 











63 131211109 8765 4 210 
CLUSTERPMUEN —! 
SMEN 
TSIDEN 
PWREN 
ERXPFGEN 
ECTLREN —4 
ACTLREN 
RESO 


Figure B2-3 ACTLR_EL3 bit assignments 
RESO, [63:13] 
RESO Reserved. 
CLUSTERPMUEN, [12] 


Performance Management Registers enable. The possible values are: 


7) CLUSTERPM* registers are not write-accessible from a lower Exception level. This is 
the reset value. 
1 CLUSTERPM* registers are write-accessible from EL2 and EL1 Secure. 
SMEN, [11] 


Scheme Management Registers enable. The possible values are: 


() Registers CLUSTERACPSID, CLUSTERSTASHSID, CLUSTERPARTCR, 
CLUSTERBUSQOS, and CLUSTERTHREADSIDOVR are not write-accessible from 
EL2 and ELI Secure. This is the reset value. 


1 Registers CLUSTERACPSID, CLUSTERSTASHSID, CLUSTERPARTCR, 
CLUSTERBUSQOS, and CLUSTERTHREADSIDOVR are write-accessible from 
EL2 and EL1 Secure. 


TSIDEN, [10] 


Thread Scheme ID Register enable. The possible values are: 


7) Register CLUSTERTHREADSID is not write-accessible from EL2 and EL1 Secure. 
This is the reset value. 
1 Register CLUSTERTHREADSID is write-accessible from EL2 and EL1 Secure. 
RESO, [9:8] 


RESO Reserved. 


PWREN, [7] 
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B2 AArch64 system registers 
B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 


Power Control Registers enable. The possible values are: 


@ Registers CPUPWRCTLR, CLUSTERPWRCTLR, CLUSTERPWRDN, 
CLUSTERPWRSTAT, CLUSTERL3HIT and CLUSTERL3MISS are not write- 
accessible from EL2 and EL1 Secure. This is the reset value. 


1 Registers CPUPWRCTLR, CLUSTERPWRCTLR, CLUSTERPWRDN, 
CLUSTERPWRSTAT, CLUSTERL3HIT and CLUSTERL3MISS are write-accessible 
from EL2 and EL1 Secure. 


RESO, [6] 
RESO Reserved. 
ERXPFGEN, [5] 


Error Record Registers enable. The possible values are: 


(7) ERXPFG* are not write-accessible from EL2 and EL1 Secure. This is the reset value. 
1 ERXPFG* are write-accessible from EL2 and EL1 Secure. 
RESO, [4:2] 


RESO Reserved. 
ECTLREN, [1] 


Extended Control Registers enable. The possible values are: 


e CPUECTLR and CLUSTERECTLR are not write-accessible from EL2 and EL1 
Secure. This is the reset value. 
1 CPUECTLR and CLUSTERECTLR are write-accessible from EL2 and EL1 Secure. 


ACTLREN, [0] 


Auxiliary Control Registers enable. The possible values are: 


e CPUACTLR and CLUSTERACTLR are not write-accessible from EL2 and EL1 
Secure. This is the reset value. 
1 CPUACTLR and CLUSTERACTLR are write-accessible from EL2 and EL1 Secure. 
Configurations 


AArch64 System register ACTLR_EL3 bits [31:0] is mapped to AArch32 register ACTLR (S). 
See B/.5 ACTLR, Auxiliary Control Register on page B1-133. 


AArch64 System register ACTLR_EL3 bits [63:32] is mapped to AArch32 register ACTLR2 
(S). See B/.6 ACTLR2, Auxiliary Control Register 2 on page B1-135. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.8 AFSRO_EL1, Auxiliary Fault Status Register 0, EL1 


B2.8 AFSRO_EL1, Auxiliary Fault Status Register 0, EL1 


AFSRO_ ELI provides additional IMPLEMENTATION DEFINED fault status information for exceptions that are 
taken to EL1. In the Cortex-A55 core, no additional information is provided for these exceptions. 
Therefore this register is not used. 


Bit field descriptions 
AFSRO_ELI is a 32-bit register, and is part of: 


¢ The Exception and fault handling registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


31 0 


po 


RESO 


Figure B2-4 AFSRO_EL1 bit assignments 
RESO, [31:0] 
Reserved, RESO. 
Configurations 


AArch64 System register AFSRO_EL1 is architecturally mapped to AArch32 System register 
ADFSR. See B/.7 ADFSR, Auxiliary Data Fault Status Register on page B1-136. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.9 AFSRO_EL2, Auxiliary Fault Status Register 0, EL2 


B2.9 AFSRO_EL2, Auxiliary Fault Status Register 0, EL2 


AFSRO_EL2 provides additional IMPLEMENTATION DEFINED fault status information for exceptions that are 
taken to EL2. 


Bit field descriptions 

AFSRO_EL2 is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Exception and fault handling registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


31 0 


po 


RESO 


Figure B2-5 AFSRO_EL2 bit assignments 
RESO, [31:0] 
Reserved, RESO. 
Configurations 


AArch64 System register AFSRO_EL2 is architecturally mapped to AArch32 System register 
HADFSR. See B/.50 HADFSR, Hyp Auxiliary Data Fault Status Syndrome Register 
on page B1-203. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.10 AFSRO_EL3, Auxiliary Fault Status Register 0, EL3 


B2.10 AFSRO_EL3, Auxiliary Fault Status Register 0, EL3 


AFSRO_EL3 provides additional IMPLEMENTATION DEFINED fault status information for exceptions that are 
taken to EL3. In the Cortex-A55 core, no additional information is provided for these exceptions. 
Therefore this register is not used. 


Bit field descriptions 
AFSRO_EL3 is a 32-bit register, and is part of: 


¢ The Exception and fault handling registers functional group. 
¢ The Security registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


31 0 


P| 


RESO 


Figure B2-6 AFSRO_EL3 bit assignments 
RESO, [31:0] 
Reserved, RESO. 
Configurations 
There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.11 AFSR1_EL1, Auxiliary Fault Status Register 1, EL1 


B2.11 AFSR1_EL1, Auxiliary Fault Status Register 1, EL1 


AFSR1_ ELI provides additional IMPLEMENTATION DEFINED fault status information for exceptions that are 
taken to EL1. This register is not used in Cortex-A55. 


Bit field descriptions 
AFSR1_ELI is a 32-bit register, and is part of: 


¢ The Exception and fault handling registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


31 0 


a 


RESO 


Figure B2-7 AFSR1_EL1 bit assignments 
RESO, [31:0] 
Reserved, RESO. 


Configurations 


AFSR1_ ELI is architecturally mapped to AArch32 register AIFSR. See B/./0 AIFSR, Auxiliary 
Instruction Fault Status Register on page B1-140. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.12 AFSR1_EL2, Auxiliary Fault Status Register 1, EL2 


B2.12 AFSR1_EL2, Auxiliary Fault Status Register 1, EL2 


AFSR1_ EL2 provides additional IMPLEMENTATION DEFINED fault status information for exceptions that are 
taken to EL2. This register is not used in the Cortex-A55 core. 


Bit field descriptions 

AFSR1_EL2 is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Exception and fault handling registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


31 0 


Po 


RESO 


Figure B2-8 AFSR1_EL2 bit assignments 
RESO, [31:0] 


Reserved, RESO. 
Configurations 


AArch64 System register AFSR1_EL2 is architecturally mapped to AArch32 System register 
HAIFSR. See B/.5/ HAIFSR, Hyp Auxiliary Instruction Fault Status Syndrome Register 
on page B1-204. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.13 AFSR1_EL3, Auxiliary Fault Status Register 1, EL3 


B2.13  AFSR1_EL3, Auxiliary Fault Status Register 1, EL3 


AFSR1_EL3 provides additional IMPLEMENTATION DEFINED fault status information for exceptions that are 
taken to EL3. This register is not used in the Cortex-A55 core. 


Bit field descriptions 
AFSR1_EL3 is a 32-bit register, and is part of: 


¢ The Exception and fault handling registers functional group. 
¢ The Security registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


31 0 


po 


RESO 


Figure B2-9 AFSR1_EL3 bit assignments 
RESO, [31:0] 
Reserved, RESO. 
Configurations 
There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.14 AIDR_EL1, Auxiliary ID Register, EL1 


B2.14 AIDR_EL41, Auxiliary ID Register, EL1 


AIDR_ELI provides IMPLEMENTATION DEFINED identification information. This register is not used in the 
Cortex-A55 core. 


Bit field descriptions 
AIDR_ELI is a 32-bit register, and is part of: 


¢ The Identification registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


This register is Read Only. 


31 0 


po 


RESO 


Figure B2-10 AIDR_EL1 bit assignments 
RESO, [31:0] 
Reserved, RESO. 


Configurations 


AIDR_EL1 is architecturally mapped to AArch32 register AIDR. See B/.9 AJDR, Auxiliary ID 
Register on page B1-139. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.15 AMAIR_EL1, Auxiliary Memory Attribute Indirection Register, EL1 


B2.15 AMAIR_EL1, Auxiliary Memory Attribute Indirection Register, EL1 


AMAIR_ ELI provides IMPLEMENTATION DEFINED memory attributes for the memory regions specified by 
MAIR ELI. This register is not used in the Cortex-A55 core. 


Bit field descriptions 
AMAIR ELI is a 64-bit register, and is part of: 


¢ The Virtual memory control registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


63 0 


aa a aiae 


RESO 


Figure B2-11 AMAIR_EL1 bit assignments 
RESO, [63:0] 


Reserved, RESO. 
Configurations 


AArch64 System register AMAIR_ ELI bits [31:0] are architecturally mapped to AArch32 
System register AMAIRO. See B/.// AMAIRO, Auxiliary Memory Attribute Indirection Register 
0 on page B1-141. 


AArch64 System register AMAIR_EL1 bits [63:32] are architecturally mapped to AArch32 
System register AMAIRI. See B/./2 AMAIRI, Auxiliary Memory Attribute Indirection Register 
1 on page B1-142. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.16 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register, EL2 


B2.16 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register, EL2 


AMAIR_EL2 provides IMPLEMENTATION DEFINED memory attributes for the memory regions specified by 
MAIR _EL2. This register is not used in the Cortex-A55 core. 


Bit field descriptions 

AMAIR EL2 is a 64-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Virtual memory control registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


63 0 


RESO 


Figure B2-12 AMAIR_EL1 bit assignments 
RESO, [63:0] 


Reserved, RESO. 


Configurations 


AArch64 System register AMAIR_EL2 bits [31:0] are architecturally mapped to AArch32 
System register HAMAIRO. See B/.52 HAMAIRO, Hyp Auxiliary Memory Attribute Indirection 
Register 0 on page B1-205. 


AArch64 System register AMAIR_EL2 bits [63:32] are architecturally mapped to AArch32 
System register HAMAIRI. See B/.53 HAMAIR1, Hyp Auxiliary Memory Attribute Indirection 
Register 1 on page B1-206. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.17 AMAIR_EL3, Auxiliary Memory Attribute Indirection Register, EL3 


B2.17 AMAIR_EL3, Auxiliary Memory Attribute Indirection Register, EL3 


AMAIR_EL3 provides IMPLEMENTATION DEFINED memory attributes for the memory regions specified by 
MAIR EL3. This register is not used in the Cortex-A55 core. 


Bit field descriptions 
AMAIR EL3 is a 64-bit register, and is part of: 


¢ The Virtual memory control registers functional group. 
¢ The Security registers functional group. 
¢ The IMPLEMENTATION DEFINED functional group. 


63 0 


RESO 


Figure B2-13 AMAIR_EL3 bit assignments 
RESO, [63:0] 
Reserved, RESO. 
Configurations 
There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.18 ATCR_EL1, Auxiliary Translation Control Register, EL1 


B2.18 ATCR_EL1, Auxiliary Translation Control Register, EL1 
The ATCR_EL1 determines the values of PBHA on page table walks memory access in EL] translation 
regime. 
Bit field descriptions 
ATCR_ ELI is a 64-bit register. 


63 14131211109 876543210 
HWVAL160 —! L_HWENO059 

= HWVAL159 HWENO60 
HWVALO60 HWEN159 


HWVALO059 HWEN160 


Figure B2-14 ATCR_EL1 bit assignments 
[63:14] 
RESO. 


HWVAL160, [13] 


Indicates the value of PBHA[1] on page table walks memory access targeting the base address 
defined by TTBR1_EL1 if HWEN160 is set. 


HWVAL1S59, [12] 


Indicates the value of PBHA[0] on page table walks memory access targeting the base address 
defined by TTBR1_EL1 if HWEN159 is set. 


[11:10] 
RESO. 


HWVAL060, [9] 


Indicates the value of PBHA[1] page table walks memory access targeting the base address 
defined by TTBRO_EL1 if HWENO060 is set. 


HWVAL0S59, [8] 


Indicates the value of PBHA[1] page table walks memory access targeting the base address 
defined by TTBRO_EL1 if HWENO0S9 is set. 


[7:6] 
RESO. 


HWEN160, [5] 


Enables PBHA[1] page table walks memory access targeting the base address defined by 
TTBRI1_ ELI. If this bit is clear, PBHA[1] on page table walks is 0. 


HWENI159, [4] 


Enables PBHA[0] page table walks memory access targeting the base address defined by 
TTBRI1_ ELI. If this bit is clear, PBHA[0] on page table walks is 0. 


[3:2] 
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B2 AArch64 system registers 
B2.18 ATCR_EL1, Auxiliary Translation Control Register, EL1 


RESO. 


HWENO060, [1] 


Enables PBHA[1] page table walks memory access targeting the base address defined by 
TTBRO_ ELI. If this bit is clear, PBHA[1] on page table walks is 0. 


HWENDS9, [0] 


Enables PBHA[0] page table walks memory access targeting the base address defined by 
TTBRO_ ELI. If this bit is clear, PBHA[0] on page table walks is 0. 


Configurations 
AArch64 register ATCR_ELI is mapped to AArch32 register ATTBCR (NS). 
At EL2 with HCR_EL2.E2H set, accesses to ATCR_EL1 are remapped to access ATCR_EL2. 


Usage constraints 
Accessing the ATCR_EL1 
To access the ATCR_EL1: 


MRS Xt , S< 3 @ c15 c7 @> ; Read ATCR_EL1 into Xt 
MSR S < 3 @ c15 cr 18 > Xt 3 Write Xt to ATCR_EL1 


This syntax is encoded with the following settings in the instruction encoding: 





Op0 | Op1 | CRn | CRm | Op2 























3 0 cl5 |c7 0 


























Accessibility 
ATCR_EL] is accessible as follows: 

Control Accessibility 

E2H | TGE | NS | ELO | EL1 | EL2 EL3 
ATCR_EL1 | x x 0 |- RW | n/a RW 
ATCR_EL1 | 0 0 1 - RW | RW RW 
ATCR_EL1 | 0 1 1 - n/a |RW RW 
ATCR_EL1 |] 1 0 1 - RW | ATCR _EL2 | RW 
ATCR_EL1 | 1 1 1 - n/a | ATCR_EL2 | RW 
































Note 


ATCR_ELI is also accessible using ATCR_EL12 when HCR.EL2.E2H is set. See 
B2.19 ATCR_EL12, Alias to Auxiliary Translation Control Register EL1 on page B2-321. 





Traps and enables 
Rules of traps and enables for this register are the same as TCR_EL1. See the Arm® Architecture 
Reference Manual Armvé8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.19 ATCR_EL12, Alias to Auxiliary Translation Control Register EL1 


B2.19 ATCR_EL12, Alias to Auxiliary Translation Control Register EL1 
The ATCR_EL12 alias allows access to ATCR_EL1 at EL2 or EL3 when HCR_EL2.E2H is set to 1. 
Usage constraints 
Accessing the ATCR_EL12 
To access the ATCR_ELlusing the ATCR_EL12 alias: 


MRS Xt , S< 3 5 c15 c7 @> ; Read ATCR_EL12/ATCR_EL1 into Xt 
MSR S < 3 By alls) CY WS 5 Me 3 Write Xt to ATCR_EL12/ATCR_EL1 


This syntax is encoded with the following settings in the instruction encoding: 





Op0 | Op1 | CRn | CRm | Op2 





3 5 15 7 0 























Accessibility 
ATCR_EL12 is accessible as follows: 











Control Accessibility 
E2H | TGE | NS | ELO/ EL1 | EL2 EL3 
ATCR_EL12 | x xX 0 |- - n/a - 





ATCR_EL12 | 0 0 1 |- - - - 
































ATCR_EL12 | 0 1 1 |- n/a |- - 
ATCR_EL12] 1 0 1 |- - ATCR_EL1 | ATCR_EL1 
ATCR_EL12| 1 1 1 |- n/a | ATCR_EL1}] ATCR_EL1 





Traps and enables 


All traps associated with the ATCR_ ELI register that apply at EL2 or EL3 also apply to the 
ATCR_EL12 alias. 


This alias is only accessible when HCR_EL2.E2H = 1. 
When HCR_EL2.E2H = 0, access to this alias is UNDEFINED. 
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B2 AArch64 system registers 
B2.20 ATCR_EL2, Auxiliary Translation Control Register, EL2 


B2.20 ATCR_EL2, Auxiliary Translation Control Register, EL2 
The ATCR_EL2 determines the values of PBHA on page table walks memory access in EL2 translation 
regime. 
Bit field descriptions 
ATCR_EL2 is a 64-bit register. 


63 14131211109 876543210 
HWVAL160 —! L_HWENO059 

= HWVAL159 HWENO60 
HWVALO60 HWEN159 


HWVALO059 HWEN160 


Figure B2-15 ATCR_EL2 bit assignments 
[63:14] 
RESO. 


HWVAL160, [13] 


Indicates the value of PBHA[1] on page table walks memory access targeting the base address 
defined by TTBR1_EL2 if HWEN160 is set. 


HWVAL1S59, [12] 


Indicates the value of PBHA[0] on page table walks memory access targeting the base address 
defined by TTBR1_EL2 if HWEN159 is set. 


[11:10] 
RESO. 


HWVAL060, [9] 


Indicates the value of PBHA[1] page table walks memory access targeting the base address 
defined by TTBRO_EL2 if HWENO060 is set. 


HWVAL0S59, [8] 


Indicates the value of PBHA[1] page table walks memory access targeting the base address 
defined by TTBRO_EL2 if HWENO0S9 is set. 


[7:6] 
RESO. 


HWEN160, [5] 


Enables PBHA[1] page table walks memory access targeting the base address defined by 
TTBRI1_EL2. If this bit is clear, PBHA[1] on page table walks is 0. 


HWENI159, [4] 


Enables PBHA[0] page table walks memory access targeting the base address defined by 
TTBRI1_EL2. If this bit is clear, PBHA[0] on page table walks is 0. 


[3:2] 
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B2 AArch64 system registers 
B2.20 ATCR_EL2, Auxiliary Translation Control Register, EL2 


RESO. 


HWEN060, [1] 


Enables PBHA[1] page table walks memory access targeting the base address defined by 
TTBRO_EL2. If this bit is clear, PBHA[1] on page table walks is 0. 


HWENO0S59, [0] 


Enables PBHA[0] page table walks memory access targeting the base address defined by 
TTBRO_EL2. If this bit is clear, PBHA[0] on page table walks is 0. 


Configurations 

AArch64 ATCR_EL2 register is architecturally mapped to AArch32 register AHTCR. 
Usage constraints 
Accessing the ATCR_EL2 

To access the ATCR_EL2: 


MRS Xt, S< 3 4 c15 c7 @> ; Read ATCR_EL2 into Xt 
MSR S < 3 4 c15 Cc? Oo} 4 RE 3; Write Xt to ATCR_EL2 


This syntax is encoded with the following settings in the instruction encoding: 





Op0 | Op1 | CRn | CRm | Op2 























3 4 cl5 |c7 0 





Accessibility 
ATCR_EL2 is accessible as follows: 





ELO (NS) | EL4 (NS) | EL14 (S) | EL2 | EL3 (SCR.NS=1) | EL3 (SCR.NS=0) 





- - - RW | RW RW 
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B2 AArch64 system registers 
B2.21 ATCR_EL3, Auxiliary Translation Control Register, EL3 


B2.21 ATCR_EL3, Auxiliary Translation Control Register, EL3 
The ATCR_EL3 determines the values of PBHA on page table walks memory access in EL3 translation 
regime. 
Bit field descriptions 
ATCR_EL3 is a 64-bit register. 


63 109 87 210 
HWVAL60 —! L_HWEN59 
RESO HWVAL59 HWENG60 
Figure B2-16 ATCR_EL3 bit assignments 
[63:10] 
RESO. 


HWVAL6O, [9] 
Indicates the value of PBHA[1] page table walks memory access if HWEN60 is set. 


HWVALSS, [8] 

Indicates the value of PBHA[1] page table walks memory access if HWENS9 is set. 
[7:2] 

RESO. 


HWEN6O0, [1] 


Enables PBHA[1] page table walks memory access. If this bit is clear, PBHA[1] on page table 
walks is 0. 


HWENSS, [0] 


Enables PBHA[0] page table walks memory access. If this bit is clear, PBHA[0] on page table 
walks is 0. 


Configurations 


AArch64 register ATCR_EL3 is architecturally mapped to AArch32 register ATCR (S). 


Usage constraints 
Accessing the ATCR_EL3 
To access the ATCR_EL3: 


MRS Xt , < 3 6 c15 c7 @> 5; Read ATCR_EL3 into Xt 
MSR S < 3 6 c15 cy 8 >. Xt 3 Write Xt to ATCR_EL3 


This syntax is encoded with the following settings in the instruction encoding: 





Op0 | Op1 | CRn | CRm | Op2 





3 6 cl5 |c7 0 
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Accessibility 
ATCR_EL3 is accessible as follows: 


B2 AArch64 system registers 
B2.21 ATCR_EL3, Auxiliary Translation Control Register, EL3 





ELO 


EL1 (NS) 


EL1 (S)|EL2 


EL3 (SCR.NS=1) 


EL3 (SCR.NS=0) 

















RW 





RW 
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B2 AArch64 system registers 
B2.22 AVTCR_EL2, Auxiliary Virtualized Translation Control Register, EL2 


B2.22 AVTCR_ELZ2, Auxiliary Virtualized Translation Control Register, EL2 


The AVTCR_EL2 determines the values of PBHA on stage 2 page table walks memory access in EL1 
Non-secure translation regime if stage 2 is enable. 


Bit field descriptions 
AVTCR_EL2 is a 64-bit register. 


63 109 87 210 
HWVAL60 —! L_HWEN59 
RESO HWVAL59 HWEN60 
Figure B2-17 AVTCR_EL2 bit assignments 
[63:10] 
RESO. 


HWVAL6O, [9] 
Indicates the value of PBHA[1] page table walks memory access if HWEN60 is set. 


HWVALSS, [8] 

Indicates the value of PBHA[1] page table walks memory access if HWENS9 is set. 
[7:2] 

RESO. 


HWENOO, [1] 


Enables PBHA[1] page table walks memory access. If this bit is clear, PBHA[1] on page table 
walks is 0. 


HWENSS, [0] 


Enables PBHA[0] page table walks memory access. If this bit is clear, PBHA[0] on page table 
walks is 0. 


Configurations 


AArch64 register AVTCR_EL2 is architecturally mapped to AArch32 register AVTCR. 


Usage constraints 
Accessing the AVTCR_EL2 
To access the AVTCR_EL2: 


MRS Xt , S< 3 4 c15 c7 1> 3; Read AVTCR_EL2 into Xt 
MSR S < 3 4 c15 G7 il & 5 OME 3 Write Xt to AVTCR_EL2 


This syntax is encoded with the following settings in the instruction encoding: 





Op0 | Op1 | CRn | CRm | Op2 





3 4 cl5 |c7 1 
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Accessibility 
AVTCR_EL2 is accessible as follows: 


B2 AArch64 system registers 
B2.22 AVTCR_EL2, Auxiliary Virtualized Translation Control Register, EL2 





ELO 


EL1 (NS) 


EL1 (S)|EL2 


EL3 (SCR.NS=1) 


EL3 (SCR.NS=0) 














- RW 





RW 





RW 
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B2 AArch64 system registers 
B2.23 CCSIDR_EL1, Cache Size ID Register, EL1 


CCSIDR_EL1, Cache Size ID Register, EL1 


The CCSIDR_EL!1 provides information about the architecture of the currently selected cache. 


Bit field descriptions 
CCSIDR_ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 30 29 28 27 13 12 3 2 0 


| NumSets Associativity 
wt — L_ WA LineSize — 
WB RA 


Figure B2-18 CCSIDR_EL1 bit assignments 





WT, [31] 
Indicates whether the selected cache level supports Write-Through: 
) Cache Write-Through is not supported at any level. 
For more information about encoding, see CCSIDR_EL/ encodings on page B2-329. 


WB, [30] 
Indicates whether the selected cache level supports Write-Back. Permitted values are: 
) Write-Back is not supported. 
1 Write-Back is supported. 


For more information about encoding, see CCSIDR_ELI encodings on page B2-329. 


RA, [29] 
Indicates whether the selected cache level supports read-allocation. Permitted values are: 
@ Read-allocation is not supported. 
1 Read-allocation is supported. 


For more information about encoding, see CCSIDR_ELI encodings on page B2-329. 


WA, [28] 
Indicates whether the selected cache level supports write-allocation. Permitted values are: 
) Write-allocation is not supported. 
1 Write-allocation is supported. 


For more information about encoding, see CCSIDR_ELI encodings on page B2-329. 


NumSets, [27:13] 


(Number of sets in cache) - 1. Therefore, a value of 0 indicates one set in the cache. The number 
of sets does not have to be a power of 2. 


For more information about encoding, see CCSIDR_EL/ encodings on page B2-329. 
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Associativity, [12:3] 


B2 AArch64 system registers 


B2.23 CCSIDR_EL1, Cache Size ID Register, EL1 


(Associativity of cache) - 1. Therefore, a value of 0 indicates an associativity of 1. The 
associativity does not have to be a power of 2. 


For more information about encoding, see CCSIDR_ELI encodings on page B2-329. 
LineSize, [2:0] 


(Log>(Number of bytes in cache line)) - 4. For example: 


Indicates the (logy (number of words in cache line)) - 2: 


For a line length of 16 bytes: Log2(16) = 4, LineSize entry = 0. This is the minimum 
line length. 


For a line length of 32 bytes: Log»(32) = 5, LineSize entry = 1. 


For more information about encoding, see CCSIDR_ELI encodings on page B2-329. 


Configurations 


CCSIDR_ELI 1s architecturally mapped to AArch32 register CCSIDR. See B/./5 CCSIDR, 
Cache Size ID Register on page B1-147. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


CCSIDR_EL1 encodings 
The following table shows the individual bit field and complete register encodings for the CCSIDR_ELI. 


Table B2-6 CCSIDR encodings 

































































CSSELR Cache Size Complete / Register bit field encoding 
register 
Level InD 0 : WT |WB |RA_ |WA_|NumSets | Associativity | LineSize 
encoding 
ebeee Q@be LI Data 16KB 7007EQ1A Q 1 1 1 Q03F 003 2 
cache 32KB | 70@FEQ1A Q07F 203 2 
64KB 7O1FEQ1A QQFF 003 2 
ebeee Q@b1 Ll 16KB 2007EQ1A Q Q 1 Q Q03F 003 2 
Instruction | 35xp | 20@FEO1A Q07F 203 a 
cache 
64KB 201FEQ1A QQFF 003 2 
@bee1 Q@be L2 cache Not See - - - - - - - 
present | following 
Note. 
64KB 7O1FEQ1A Q 1 1 1 QQOFF 003 2 
128KB 703FEQ1A Q1FF 003 2 
256KB 707FEQ1A Q@3FF 003 2 
@bee1 @b1 Reserved - - - - - - - - - 
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B2 AArch64 system registers 


B2.23 CCSIDR_EL1, Cache Size ID Register, EL1 


Table B2-6 CCSIDR encodings (continued) 






















































































CSSELR Cache Size Complete | Register bit field encoding 
Level |InD ei wt /we |RA_ |WA_ |NumSets | Associativity | LineSize 
@be10 @be L3 cache 256KB | 701FE07A Q 1 1 1 QQOF OOF 2 
512KB_ | 703FEQ7A Q1FF GOF 2 
1MB 707FEQ7A O3FF GOF 2 
2MB 7OFFEQ7A O7FF GOF 2 
4MB 71FFEQ7A OFFF GOF 2 
8MB 73FFEQ7A 1FFF GQOF 2 
0be101 - Reserved - - - - - - - - - 
@b1111 
Note 





If no L2 cache is present the core uses L3 cache as L2, and the L3 encodings apply. 
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B2 AArch64 system registers 
B2.24 CLIDR_EL1, Cache Level ID Register, EL1 


B2.24 CLIDR_EL1, Cache Level ID Register, EL1 


The CLIDR_ELI identifies the type of cache, or caches, implemented at each level, up to a maximum of 
seven levels. 


It also identifies the Level of Coherency (LoC) and Level of Unification (LoU) for the cache hierarchy. 


Bit field descriptions 
CLIDR_ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


63 3332, 3029 2726 2423 2120 9 8 6 5 3 2 0 
RESO 


Figure B2-19 CLIDR_EL1 bit assignments 

RESO, [63:33] 

RESO Reserved. 
ICB, [32:30] 

Inner cache boundary. This field indicates the boundary between the inner and the outer domain: 

ee1 LI cache is the highest inner level. 

010 L2 cache is the highest inner level. 

e11 L3 cache is the highest inner level. 
LoUU, [29:27] 

Indicates the Level of Unification Uniprocessor for the cache hierarchy: 


eee No levels of cache need to cleaned or invalidated when cleaning or invalidating to the 
Point of Unification. This is the value if no cache are configured. 


LoC, [26:24] 
Indicates the Level of Coherency for the cache hierarchy: 


001 L2 and L3 cache are not implemented. 
010 L2 or L3 cache is not implemented. 
@11 L2 and L3 cache are implemented. 


LoUIS, [23:21] 
Indicates the Level of Unification Inner Shareable (LoUIS) for the cache hierarchy. 


@beee No levels of cache need to be cleaned or invalidated when cleaning or invalidating to 
the Point of Unification. 


RESO, [20:9] 
No cache at levels L7 down to L4. 


RESO Reserved. 
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B2 AArch64 system registers 
B2.24 CLIDR_EL1, Cache Level ID Register, EL1 


Ctype3, [8:6] 


Indicates the type of cache if the cluster implements L3 cache. If present, unified instruction and 
data caches at Level-3: 


eee L2 or L3 cache is not implemented. 
100 L2 and L3 cache are implemented. 


If Ctype2 has a value of 3b@0@, the value of Ctype3 must be ignored. 


Ctype2, [5:3] 


Indicates the type of cache if the core implements L2 cache. If present, unified instruction and 
data caches at Level-2: 


eee L2 and L3 cache are not implemented. 
100 L2 or L3 cache is implemented as a unified cache. 


Ctypel, [2:0] 


Indicates the type of cache implemented at L1: 


Q11 Separate instruction and data caches at L1. 


Configurations 


CLIDR_ ELI is architecturally mapped to AArch32 register CLIDR. See B/./6 CLIDR, Cache 
Level ID Register on page B1-150. 
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B2 AArch64 system registers 
B2.25 CPACR_EL1, Architectural Feature Access Control Register, EL1 


B2.25 CPACR_EL1, Architectural Feature Access Control Register, EL1 


The CPACR_ELI controls access to Advanced SIMD and floating-point functionality from ELO, EL1, 
and EL3. 


Bit field descriptions 


CPACR_ EL] is a 32-bit register, and is part of the Other system control registers functional group. 


31 22 21 20.19 0 
L_FPEN 
RESO 


Figure B2-20 CPACR_EL1 bit assignments 
RESO, [31:22] 


RESO Reserved. 


FPEN, [21:20] 


Traps instructions that access registers associated with Advanced SIMD and floating-point 
execution to trap to EL1 when executed from ELO or EL1. The possible values are: 


@bee@ Trap any instruction in ELO or EL] that uses registers associated with Advanced 
SIMD and floating-point execution. The reset value is @b@@. 


@b@1 _— Trap any instruction in ELO that uses registers associated with Advanced SIMD and 
floating-point execution. Instructions in EL1 are not trapped. 


@b1@ _— Trap any instruction in ELO or EL] that uses registers associated with Advanced 
SIMD and floating-point execution. 


@b11 No instructions are trapped. 
This field is Reso if Advanced SIMD and floating-point are not implemented. 
RESO, [19:0] 


RESO Reserved. 


Configurations 


CPACR_EL1 is architecturally mapped to AArch32 register CPACR. See B/.17 CPACR, 
Architectural Feature Access Control Register on page B1-152. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.26 CPTR_EL2, Architectural Feature Trap Register, EL2 


B2.26 CPTR_EL2, Architectural Feature Trap Register, EL2 


The CPTR_EL2 controls trapping to EL2 for accesses to CPACR, trace functionality and registers 
associated with Advanced SIMD and floating-point execution. It also controls EL2 access to this 
functionality. 


Bit field descriptions 


CPTR_EL2 is a 32-bit register, and is part of the Virtualization registers functional group. 


31 30 21 20 19 14131211 10 9 0 
LTCPAC LTTA LTFP 
RES1 
RESO 


Figure B2-21 CPTR_EL2 bit assignments 
TTA, [20] 


Trap Trace Access. 
This bit is not implemented. REso. 
Configurations 
CPTR_EL2 is architecturally mapped to AArch32 register HCPTR. 
RW fields in this register reset to UNKNOWN values. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.27 CPTR_EL3, Architectural Feature Trap Register, EL3 


B2.27 CPTR_EL3, Architectural Feature Trap Register, EL3 


The CPTR_EL3 controls trapping to EL3 of access to CPACR_EL1, CPTR_EL2, trace functionality and 
registers associated with Advanced SIMD and floating-point execution. 


It also controls EL3 access to trace functionality and registers associated with Advanced SIMD and 
floating-point execution. 


Bit field descriptions 


CPTR_EL3 is a 32-bit register, and is part of the Security registers functional group. 
































31 30 21 20:19 1110 9 0 
_TTA 
_TCPAC 
_TFP 
RESO 


Figure B2-22 CPTR_EL3 bit assignments 
TTA, [20] 


Trap Trace Access. 
Not implemented. REso. 
TFP, [10] 


This causes instructions that access the registers that are associated with Advanced SIMD or 
floating-point execution to trap to EL3 when executed from any Exception level, unless trapped 
to EL1 or EL2. The possible values are: are: 


7) Does not cause any instruction to be trapped. This is the reset value if the Advanced 
SIMD and floating-point support is implemented. 


1 Causes any instructions that use the registers that are associated with Advanced SIMD 
or floating-point execution to be trapped. This is always the value if the Advanced 
SIMD and floating-point support is not implemented. 


Configurations 
There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.28 CPUACTLR_EL1, CPU Auxiliary Control Register, EL1 


B2.28 CPUACTLR_EL1, CPU Auxiliary Control Register, EL1 


The CPUACTLR_EL] provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 


CPUACTLR_ ELI is a 64-bit register, and is part of the IMPLEMENTATION DEFINED registers functional 
group. 


63 0 


Reserved 


Figure B2-23 CPUACTLR_EL1 bit assignments 
Reserved, [63:0] 


Reserved for Arm internal use. 


Configurations 
CPUACTLR_ ELI is: 
* Common to the Secure and Non-secure states. 
¢ Mapped to the AArch32 CPUACTLR register. See B/./8 CPUACTLR, CPU Auxiliary 
Control Register on page B1-153. 


Usage constraints 
Accessing the CPUACTLR_EL1 


The CPU Auxiliary Control Register can be written only when the system is idle. Arm 
recommends that you write to this register after a powerup reset, before the MMU is enabled. 


Setting many of these bits can cause significantly lower performance on your code. Therefore, 
Arm strongly recommends that you do not modify this register unless directed by Arm. 


This register is accessible as follows: 

This register can be read with the MRS instruction using the following syntax: 
MRS <Xt>,<systemreg> 

This register can be written with the MSR instruction using the following syntax: 
MSR <systemreg>, <Xt> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0|op1|CRn|CRm | op2 























$3_0 C15 C10} 11 | 000 | 1111 | 0001 | 000 





Accessibility 


This register is accessible in software as follows: 
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B2 AArch64 system registers 


B2.28 CPUACTLR_EL1, CPU Auxiliary Control Register, EL1 






































<systemreg> Control Accessibility 

E2H |TGE |NS ELO |EL1 |EL2 |EL3 
$3_0_C15_ Cl_0 x x 0 - RW n/a RW 
$3_0_C15_ Cl_0 x 0 1 - RW RW RW 
$3_0_C15_ Cl_0 x 1 1 - n/a RW RW 











‘n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Synchronous exception 
prioritization in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture 


profile. 
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B2 AArch64 system registers 
B2.29 CPUCFR_EL1, CPU Configuration Register, EL1 


B2.29 CPUCFR_EL1, CPU Configuration Register, EL1 
The CPUCFR_ELI provides configuration information for the core. 
Bit field descriptions 
CPUCFR_ELI is a 32-bit register, and is part of the IMPLEMENTATION DEFINED registers functional group. 


This register is Read Only. 


31 3210 
sd | 
L—scu 

RESO 


Figure B2-24 CPUCFR_EL1 bit assignments 


RESO, [31:3] 
Reserved, RESO. 
SCU, [2] 
Indicates whether the SCU is present or not. The value is: 
) The SCU is present. 
ECC, [1:0] 
Indicates whether ECC is present or not. The possible values are: 
ee ECC is not present. 
@1 ECC is present. 
Configurations 


CPUCFR_ ELI is architecturally mapped to AArch32 register CPUCFR. See B/./9 CPUCFR, 
CPU Configuration Register on page B1-155. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


Usage constraints 
Accessing the CPUCFR_EL1 
This register can be read with the MRS instruction using the following syntax: 
MRS <Xt>,<systemreg> 
To access the CPUCFR_ELI: 
MRS <Xt>, CPUCFR_EL1 ; Read CPUCFR_EL1 into Xt 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0|op1|CRn|CRm | op2 





$3.0 C15 COO} 11 |000 | 1111 | 0000 | 000 
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Accessibility 


B2 AArch64 system registers 
B2.29 CPUCFR_EL1, CPU Configuration Register, EL1 

















This register is accessible in software as follows: 
<systemreg> Control Accessibility 
E2H |TGE |NS ELO |EL1 /|EL2 |EL3 
$3_0_C15_C0_0 x x 0 : RO |n/a |RO 
$3_0_C15_C0_0 x 0 1 4 RO |RO |RO 
$3_0_C15_C0_0 x 1 1 4 na |RO |RO 
































'n/a' Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 
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B2 AArch64 system registers 
B2.30 CPUECTLR_EL1, CPU Extended Control Register, EL1 


B2.30 CPUECTLR_EL1, CPU Extended Control Register, EL1 


The CPUECTLR_ ELI provides extra IMPLEMENTATION DEFINED configuration and control options for the 
core. 


Bit field descriptions 
CPUECTLR_ ELI is a 64-bit register, and is part of the 64-bit registers functional group. 


63 40 39 38 37 36 31 30 29 28:27 26 25 24 1615 1312 109 10 


aE 


ATOM 4 he Ee EXTLLC 
L2FLUSH L3PCTL 





LIPCTL 
L3WSCTL 
L2WSCTL 
LAWSCTL 
RESO 
Figure B2-25 CPUECTLR_EL1 bit assignments 
RESO, [63:40] 
RESO Reserved. 
ATOM, [39:38] 

ee Atomic instructions are performed near if they hit in the cache in a unique state, or far 
if they miss or are shared. For more details, see 46.4.1 Memory system implementation 
on page A6-80. This is the default. 

@1 Force all cacheable atomic instructions to be executed near, in the L1 cache. 

10 Force most cacheable atomic instructions to be executed far, in the L3 cache or 
beyond. 

11 Force cacheable load atomics, including SWP and CAS, to be executed near, in the L1 
cache. Store atomics are performed near if they hit in the cache in a unique state, or far 
if they miss or are shared. 

L2FLUSH, [37] 

) L2 cache flushes, for example during a core powerdown sequence, cause clean lines to 
be allocated into the L3 cache rather than discarding them. This can improve 
performance if it is known that the data is likely to be used soon by another core. 

RESO, [36:31] 
RESO Reserved. 
L3WSCTL, [30:29] 

Write streaming no-L3-allocate threshold. The possible values are: 

ee 128th consecutive streaming cache line does not allocate in the L1, L2, or L3 cache. 

e@1 1024th consecutive streaming cache line does not allocate in the L1, L2, or L3 cache. 
This is the reset value. 

10 4096th consecutive streaming cache line does not allocate in the L1, L2, or L3 cache. 

11 Disables streaming. All write-allocate lines allocate in the L1, L2, or L3 cache. 
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B2 AArch64 system registers 
B2.30 CPUECTLR_EL1, CPU Extended Control Register, EL1 


L2WSCTL, [28:27] 


Write streaming no-L2-allocate threshold. The possible values are: 
ee 16th consecutive streaming cache line does not allocate in the L1 or L2 cache. 


e1 128th consecutive streaming cache line does not allocate in the L1 or L2 cache. This is 
the reset value. 


10 512th consecutive streaming cache line does not allocate in the L1 or L2 cache. 


11 Disables streaming. All write-allocate lines allocate in the L1 or L2 cache. 


LIWSCTL, [26:25] 


Write streaming no-L1-allocate threshold. The possible values are: 


ee 4th consecutive streaming cache line does not allocate in the L1 cache. This is the 
reset value. 


e1 64th consecutive streaming cache line does not allocate in the L1 cache. 
10 128th consecutive streaming cache line does not allocate in the L1 
11 Disables streaming. All write-allocate lines allocate in the L1 cache. 


RESO, [24:16] 


RESO Reserved. 


LIPCTL, [15:13] 


LI Data prefetch control. The value of the LIPCTL field determines the maximum number of 
outstanding data prefetches allowed in the L1 memory system (not counting the data prefetches 
generated by software load/PLD instructions). 


eee Prefetch disabled. 

ee1 1 outstanding prefetch allowed. 

e10 2 outstanding prefetches allowed. 

@11 3 outstanding prefetches allowed. 

100 4 outstanding prefetches allowed. 

101 5 outstanding prefetches allowed. This is the reset value. 
110 6 outstanding prefetches allowed. 


111 7 outstanding prefetches allowed. 


L3PCTL, [12:10] 


L3 Data prefetch control. The value of the L3PCTL field determines the approximate distance 
between the L1 prefetcher and requests sent to the L3 memory system. Increasing this distance 
may improve performance on systems with higher latency to main memory, but increasing it too 
far can reduce performance. 

Note 


The L3 memory system may have more outstanding access to the system than this number. 








eee Fetch 16 lines ahead. 
ee1 Fetch 32 lines ahead. 


@10 Reserved. 
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B2 AArch64 system registers 
B2.30 CPUECTLR_EL1, CPU Extended Control Register, EL1 


Q11 Reserved. 

100 Disable L3 prefetching. 
101 Fetch 2 lines ahead. 
110 Fetch 4 lines ahead. 


111 Fetch 8 lines ahead. This is the reset value. 


RESO, [9:1] 
RESO Reserved. 


EXTLLCG, [0] 


7) Indicates that an external Last-level cache is present in the system, and that the 
DataSource field on the master CHI interface indicates when data is returned from the 
LLC. This is used to control how the LL_CACHE* PMU events count. 


Configurations 


The CPUECTLR_ELI is mapped to the AArch32 CPUECTLR register. See B/.20 CPUECTLR, 
CPU Extended Control Register on page B1-157. 


Usage constraints 
Accessing the CPUECTLR_EL1 
The CPUECTLR_ ELI can be written dynamically. 
This register is accessible as follows: 
This register can be read with the MRS instruction using the following syntax: 
MRS <Xt>,<systemreg> 
This register can be written with the MRS instruction using the following syntax: 
MSR <systemreg>, <Xt> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> op0 | op1 | CRn | CRm | op2 





CPUECTLR_EL1/11 | 000 | 1111 |0001 | 100 























Accessibility 


This register is accessible in software as follows: 





<systemreg> Control Accessibility 





E2H |TGE |NS ELO |EL1 |EL2 |EL3 























CPUECTLR_EL1 xX x 0 - RW n/a RW 
CPUECTLR_EL1 X 0 1 - RW RW RW 
CPUECTLR_EL1 x 1 1 - n/a RW RW 




















‘n/a’ Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 
Traps and enables 


For a description of the prioritization of any generated exceptions, see Synchronous exception 
prioritization in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture 


profile. 
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B2 AArch64 system registers 
B2.31 CPUPCR_EL3, CPU Private Control Register, EL3 


B2.31 CPUPCR_EL3, CPU Private Control Register, EL3 


The CPUPCR_EL3 provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 


CPUPCR_ELS3 is a 64-bit register, and is part of the IMPLEMENTATION DEFINED registers functional group. 


63 0 


Reserved 


Figure B2-26 CPUPCR_EL3 bit assignments 
Reserved, [63:0] 


Reserved for Arm internal use. 


Configurations 
CPUPCR_EL3 is: 


¢ Only accessible in Secure state. 
¢ Mapped to the AArch32 CPUPCR register. See B/.2/ CPUPCR, CPU Private Control 
Register on page B1-161. 


Usage constraints 
Accessing the CPUPCR_EL3 


The CPUPCR_EL3 can be written only when the system is idle. Arm recommends that you 
write to this register after a powerup reset, before the MMU is enabled. 


Writing to this register might cause UNPREDICTABLE behaviors. Therefore, Arm strongly 
recommends that you do not modify this register unless directed by Arm. 


This register is accessible as follows: 

This register can be read with the MRS instruction using the following syntax: 
MRS <Xt>,<systemreg> 

This register can be written with the MSR instruction using the following syntax: 
MSR <systemreg>, <Xt> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0 | op1 | CRn | CRm | op2 





$3.6 C15 8 1}11 |110 | 1111 | 1000 | 001 























Accessibility 


This register is accessible in software as follows: 


















































<systemreg> Control Accessibility 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
S3_6 C15 8 1 X Xx 0 - - n/a RW 
$3.6 C15 8 1 Xx 0 1 - - - RW 
$3.6 C15 8 1 Xx 1 1 - n/a - RW 
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B2 AArch64 system registers 
B2.31 CPUPCR_EL3, CPU Private Control Register, EL3 


‘n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 
Traps and enables 


For a description of the prioritization of any generated exceptions, see Synchronous exception 
prioritization in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture 


profile. 
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B2 AArch64 system registers 
B2.32 CPUPMR_EL3, CPU Private Mask Register, EL3 


B2.32 CPUPMR_EL3, CPU Private Mask Register, EL3 


The CPUPMR_EL3 provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 


CPUPMR EL3 is a 64-bit register, and is part of the IMPLEMENTATION DEFINED registers functional group. 


63 0 


Reserved 


Figure B2-27 CPUPMR_EL3 bit assignments 
Reserved, [63:0] 


Reserved for Arm internal use. 


Configurations 
CPUPMR _ EL3 is: 
¢ Only accessible from Secure state. 
¢ Mapped to the AArch32 CPUPMR register. See B/.22 CPUPMR, CPU Private Mask 
Register on page B1-163. 
Usage constraints 
Accessing the CPUPMR_EL3 


The CPUPMR_EL3 can be written only when the system is idle. Arm recommends that you 
write to this register after a powerup reset, before the MMU is enabled. 


Writing to this register might cause UNPREDICTABLE behaviors. Therefore, Arm strongly 
recommends that you do not modify this register unless directed by Arm. 


This register is accessible as follows: 

This register can be read with the MRS instruction using the following syntax: 
MRS <Xt>,<systemreg> 

This register can be written with the MSR instruction using the following syntax: 
MSR <systemreg>, <Xt> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0 | op1 | CRn | CRm | op2 





$3_6 C15 8 3} 11 |110 | 1111 | 1000 | 011 























Accessibility 


This register is accessible in software as follows: 


















































<systemreg> Control Accessibility 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
S3_6 C15 8 3 X Xx 0 - - n/a RW 
S$3_6 C15 8 3 Xx 0 1 - - - RW 
$3.6 C15 8 3 Xx 1 1 - n/a - RW 
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B2 AArch64 system registers 
B2.32 CPUPMR_EL3, CPU Private Mask Register, EL3 


'n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 
Traps and enables 


For a description of the prioritization of any generated exceptions, see Synchronous exception 
prioritization in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture 


profile. 
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B2 AArch64 system registers 
B2.33 CPUPOR_EL3, CPU Private Operation Register, EL3 


B2.33 CPUPOR_EL3, CPU Private Operation Register, EL3 


The CPUPOR_EL3 provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 


CPUPOR EL3 is a 64-bit register, and is part of the IMPLEMENTATION DEFINED registers functional group. 


63 0 


Reserved 


Figure B2-28 CPUPOR_EL3 bit assignments 
Reserved, [63:0] 


Reserved for Arm internal use. 


Configurations 
CPUPOR _EL3 is: 


¢ Only accessible in Secure state. 
* Mapped to the AArch32 CPUPOR register. See B/.23 CPUPOR, CPU Private Operation 
Register on page B1-165. 


Usage constraints 
Accessing the CPUPOR_EL3 


The CPUPOR_EL3 can be written only when the system is idle. Arm recommends that you 
write to this register after a powerup reset, before the MMU is enabled. 


Writing to this register might cause UNPREDICTABLE behaviors. Therefore, Arm strongly 
recommends that you do not modify this register unless directed by Arm. 


This register is accessible as follows: 

This register can be read with the MRS instruction using the following syntax: 
MRS <Xt>,<systemreg> 

This register can be written with the MSR instruction using the following syntax: 
MSR <systemreg>, <Xt> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0 | op1 | CRn | CRm | op2 





$3_6 C15 8 2/11 |110 | 1111 | 1000 | 010 























Accessibility 


This register is accessible in software as follows: 


















































<systemreg> Control Accessibility 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
S3_6 C15 8 2 X Xx 0 - - n/a RW 
S3_6 C15 8 2 Xx 0 1 - - - RW 
S3_6 C15 8 2 Xx 1 1 - n/a - RW 
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B2 AArch64 system registers 
B2.33 CPUPOR_EL3, CPU Private Operation Register, EL3 


'n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 
Traps and enables 


For a description of the prioritization of any generated exceptions, see Synchronous exception 
prioritization in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture 


profile. 
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B2 AArch64 system registers 
B2.34 CPUPSELR_EL3, CPU Private Selection Register, EL3 


B2.34 CPUPSELR_EL3, CPU Private Selection Register, EL3 


The CPUPSELR_EL3 provides IMPLEMENTATION DEFINED configuration and control options for the core. 


Bit field descriptions 


CPUPSELR_EL3 is a 32-bit register, and is part of the IMPLEMENTATION DEFINED registers functional group. 


31 0 


Figure B2-29 CPUPSELR_EL3 bit assignments 
Reserved, [31:0] 


Reserved for Arm internal use. 


Configurations 
CPUPSELR_ELS3 is: 
¢ Only accessible in Secure state. 


¢ Mapped to the AArch32 CPUPSELR register. See B/.24 CPUPSELR, CPU Private 
Selection Register on page B1-167. 
Usage constraints 
Accessing the CPUPSELR_EL3 


The CPUPSELR_EL3 can be written only when the system is idle. Arm recommends that you 
write to this register after a powerup reset, before the MMU is enabled. 


Writing to this register might cause UNPREDICTABLE behaviors. Therefore, Arm strongly 
recommends that you do not modify this register unless directed by Arm. 


This register is accessible as follows: 

This register can be read with the MRS instruction using the following syntax: 
MRS <Xt>,<systemreg> 

This register can be written with the MSR instruction using the following syntax: 
MSR <systemreg>, <Xt> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0 | op1 | CRn | CRm | op2 





$3.6 C158 0/11 {110 | 1111 | 1000 | 000 























Accessibility 


This register is accessible in software as follows: 















































<systemreg> Control Accessibility 
E2H |TGE |NS ELO |EL1 |EL2 |EL3 
S3_6 C15 8 0 X Xx 0 - - n/a RW 
S$3_6 C15 8 0 x 0 1 - - - RW 
S3_6 C15 8 0 Xx 1 1 - n/a - RW 
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B2 AArch64 system registers 
B2.34 CPUPSELR_EL3, CPU Private Selection Register, EL3 


'n/a' Not accessible. The core cannot be executing at this Exception level, so this access is not possible. 
Traps and enables 


For a description of the prioritization of any generated exceptions, see Synchronous exception 
prioritization in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture 


profile. 
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B2 AArch64 system registers 
B2.35 CPUPWRCTLR_EL1, Power Control Register, EL1 


B2.35 CPUPWRCTLR_EL1, Power Control Register, EL1 
The CPUPWRCTLR_ELI provides information about power control support for the core. 


Bit field descriptions 


CPUPWRCTLR_ ELI is a 32-bit register, and is part of the IMPLEMENTATION DEFINED registers functional 
group. 


31 1312 109 7 6 4 3 10 


__  eiFhE I 


SIMD_RET_CTRL —! a 
WFE_RET_CTRL 
WEFI_RET_CTRL 


CORE_PWRDN_EN 
RESO - _ 


Figure B2-30 CPUPWRCTLR_EL1 bit assignments 
RESO, [31:13] 
RESO Reserved. 
SIMD_RET_CTRL, [12:10] 
Advanced SIMD and floating-point retention control: 


eee Disable the retention circuit. This is the default value, see Zable B2-7 CPUPWRCTLR 
Retention Control Field on page B2-352 for more retention control options. 


WFE_RET_CTRL, [9:7] 
CPU WFE retention control: 


eee Disable the retention circuit. This is the default value, see Zable B2-7 CPUPWRCTLR 
Retention Control Field on page B2-352 for more retention control options. 


WFL RET_CTRL, [6:4] 
CPU WFI retention control: 


eee Disable the retention circuit. This is the default value, see Zable B2-7 CPUPWRCTLR 
Retention Control Field on page B2-352 for more retention control options. 


RESO, [3:1] 
RESO Reserved. 
CORE_PWRDN EN, [0] 


Indicates to the power controller using PACTIVE if the core wants to power down when it 
enters WFI state. 





7) No power down requested. This is the reset value. 
1 A power down is requested. 
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B2 AArch64 system registers 
B2.35 CPUPWRCTLR_EL1, Power Control Register, EL1 


Table B2-7 CPUPWRCTLR Retention Control Field 





























Encoding | Number of counter ticks‘ | yjinimum retention entry delay 
(System counter at 50MHz-10MHz) 

eee Disable the retention circuit | Default Condition. 

ee1 2; 40ns-200ns 

e010 8 160ns-800ns 

011 32 640ns — 3,200ns 

100 64 1,280ns-6,400ns 

101 128 2,560ns-12,800ns 

110 256 5,120ns-25,600ns 

111 512 10,240ns-51,200ns 














Configurations 


CPUPWRCTLR_ ELI is architecturally mapped to AArch32 register CPUPWRCTLR. See 
B1.25 CPUPWRCTLR, CPU Power Control Register on page B1-169. 


Usage constraints 
Accessing the CPUPWRCTLR ELI 
This register can be read using MRS with the following syntax: 
MRS <Xt>,<systemreg> 
This register can be written using MSR with the following syntax: 
MSR <systemreg>, <Xt> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0|op1|CRn|CRm | op2 























$3_0_C15_C2_7}11 | 000 | 1111 |0010 | 111 





Accessibility 


This register is accessible in software as follows: 





<systemreg> Control Accessibility 





E2H |TGE |NS ELO |EL1 |EL2 |EL3 






































$3.0 C15 C27 x x 0 Z RW |n/a |RW 
$3.0 C15 C27 x 0 1 - RW |RW /RW 
$3.0 C15 C27 x 1 1 2 wa |RW |RW 





‘n/a' Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 





d The number of system counter ticks required before the core signals retention readiness on PACTIVE to the power controller. The core does not accept a retention 
entry request until this time. 
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B2 AArch64 system registers 
B2.35 CPUPWRCTLR_EL1, Power Control Register, EL1 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. 


Write access to this register from EL1 or EL2 depends on the value of bit[7] of ACTLR_EL2 
and ACTLR_EL3. 
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B2 AArch64 system registers 
B2.36 CSSELR_EL1, Cache Size Selection Register, EL1 


B2.36 CSSELR_EL1, Cache Size Selection Register, EL1 
CSSELR_EL] selects the current Cache Size ID Register (CCSIDR_EL1), by specifying: 


The required cache level. 
The cache type, either instruction or data cache. 


For details of the CCSIDR_EL1, see B2.23 CCSIDR_EL1, Cache Size ID Register, ELI on page B2-328. 


Bit field descriptions 


CSSELR_ ELI is a 32-bit register, and is part of the Identification registers functional group. 


[31:4] 


31 4 3 10 


inp! 


RESO 


Figure B2-31 CSSELR_EL1 bit assignments 


RESO Reserved. 


Level, [3:1] 


InD, [0] 


Cache level of required cache: 


800 Ll. 
001 L2. 
010 L3, if present. 


The combination of Level=001 and InD=1 is reserved. 


The combinations of Level and InD for 100 to 1111 are reserved. 


Instruction not Data bit: 
@ Data or unified cache. 
1 Instruction cache. 


The combination of Level=001 and InD=1 is reserved. 


The combinations of Level and InD for 0100 to 1111 are reserved. 


Configurations 


CSSELR_ ELI is architecturally mapped to AArch32 register CSSELR(NS). See 
B1.26 CSSELR, Cache Size Selection Register on page B1-172. 


If a cache level is missing but CSSELR_ELI selects this level, then a CCSIDR_EL1 read 
returns an UNKNOWN value. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.37 CTR_ELO, Cache Type Register, ELO 


CTR_ELO, Cache Type Register, ELO 


The CTR_ELO provides information about the architecture of the caches. 


Bit field descriptions 
CTR_ELO is a 32-bit register, and is part of the Identification registers functional group. 


This register is Read Only. 


3130 2827 24 23 20 19 16 15 14 13 4 3 0 





RES1 
RESO 
Figure B2-32 CTR_ELO bit assignments 
RES1, [31] 
RES1 Reserved. 


RESO, [30:28] 
RESO Reserved. 
CWG, [27:24] 


Cache write-back granule. Log, of the number of words of the maximum size of memory that 
can be overwritten as a result of the eviction of a cache entry that has had a memory location in 
it modified: 


@10@ Cache write-back granule size is 16 words. 


ERG, [23:20] 


Exclusives Reservation Granule. Log, of the number of words of the maximum size of the 
reservation granule that has been implemented for the Load-Exclusive and Store-Exclusive 
instructions: 


e10@ ~—sExcllusive reservation granule size is 16 words. 
DminLine, [19:16] 


Log) of the number of words in the smallest cache line of all the data and unified caches that the 
core controls: 


@10@ Smallest data cache line size is 16 words. 

L1Ip, [15:14] 
Instruction cache policy. Indicates the indexing and tagging policy for the L1 Instruction cache: 
10 Virtually Indexed Physically Tagged (VIPT). 

RESO, [13:4] 


RESO Reserved. 


IminLine, [3:0] 
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B2 AArch64 system registers 
B2.37 CTR_ELO, Cache Type Register, ELO 


Log, of the number of words in the smallest cache line of all the instruction caches that the core 
controls. 


e100 Smallest instruction cache line size is 16 words. 


Configurations 
AArch64 System register CTR_ELO is architecturally mapped to AArch32 register CTR. See 
B1.27 CTR, Cache Type Register on page B1-173. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.38 DCZID_ELO, Data Cache Zero ID Register, ELO 


B2.38 DCZID_ELO, Data Cache Zero ID Register, ELO 


The DCZID_ELO indicates the block size written with byte values of zero by the DC ZVA (Data Cache 
Zero by Address) system instruction. 


Bit field descriptions 
DCZID_ELO is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 5 4:3 0 
pbzP— 
RESO 


Figure B2-33 DCZID_ELO bit assignments 
RESO, [31:5] 
RESO Reserved. 
BlockSize, [3:0] 
Log) of the block size in words: 


e100 = The block size is 16 words. 


Configurations 
There are no configuration notes. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.39 DISR_EL1, Deferred Interrupt Status Register, EL1 


B2.39 DISR_EL1, Deferred Interrupt Status Register, EL1 
The DISR_EL! records the SError interrupts consumed by an ESB instruction. 


Bit field descriptions 


DISR_ELI is a 64-bit register, and is part of the registers Reliability, Availability, Serviceability (RAS) 
functional group. 


63 323130 2524 23 1312 109 6 5 2 
$ 
IDS 
DFSC 


RESO 


Figure B2-34 DISR_EL1 bit assignments, DISR_EL1.IDS is 0 


RESO, [63:32] 
Reserved, RESO. 


A, [31] 


Set to 1 when ESB defers an asynchronous SError interrupt. If the implementation does not 
include any synchronizable sources of SError interrupt, this bit is REso. 


RESO, [30:25] 
Reserved, RESO. 


IDS, [24] 
Indicates the type of format the deferred SError interrupt uses. The value of this bit is: 


@ Deferred error uses architecturally-defined format. 


RESO, [23:13] 
Reserved, RESO. 


AET, [12:10] 


Asynchronous Error Type. Describes the state of the core after taking an asynchronous Data 
Abort exception. The value or values are: 


@bee1 Unrecoverable error (UEU). 


All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 


In the event of multiple errors taken as a single SError interrupt exception, the overall state of 
the PE is reported. For example, if both a Recoverable and Unrecoverable error occurred, the 
state is Unrecoverable. 
Note 
¢ This field is only valid if IDS == @be@ and DFSC == @be10e01. 
¢ The recovery software must also examine any implemented fault records to determine the 
location and extent of the error. 
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B2 AArch64 system registers 
B2.39 DISR_EL1, Deferred Interrupt Status Register, EL1 


RESO, [9:6] 
Reserved, RESO. 


DFSC, [5:0] 
Data Fault Status Code. The possible values are: 


@10001 Asynchronous SError Interrupt when the core is executing in AArch64 state or at EL2, 
or when the core is executing in AArch32 state at EL1, and the Extended Address 
Enable bit is at 1 in TTBCR. 


g@0118@ Asynchronous SError Interrupt when the core is executing in AArch32 state at EL1 
and the Extended Address Enable is at 0 in TTBCR. 


Configurations 


AArch64 System register DISR_EL1 is architecturally mapped to AArch32 register DISR. See 
B1.29 DISR, Deferred Interrupt Status Register on page B1-177. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.40 ERRIDR_EL1, Error ID Register, EL1 


B2.40 ERRIDR_EL1, Error ID Register, EL1 
The ERRIDR_ELI defines the number of error record registers. 


Bit field descriptions 


ERRIDR_ ELI is a 32-bit register, and is part of the registers Reliability, Availability, Serviceability 
(RAS) functional group. 


This register is Read Only. 


31 1615 0 


RESO 


Figure B2-35 ERRIDR_EL1 bit assignments 
RESO, [31:16] 
RESO Reserved. 
NUM, [15:0] 
Number of records that can be accessed through the Error Record system registers. 


@x@e02 Two records present. 


Configurations 


ERRIDR_ ELI is architecturally mapped to AArch32 register ERRIDR. See B/.30 ERRIDR, 
Error ID Register on page B1-181. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.41 ERRSELR_EL1, Error Record Select Register, EL1 


B2.41 ERRSELR_EL1, Error Record Select Register, EL1 


The ERRSELR_ELI selects which error record should be accessed through the Error Record system 
registers. This register is not reset on a warm reset. 


Bit field descriptions 
ERRSELR_ELI is a 64-bit register, and is part of the Reliability, Availability, Serviceability (RAS) 
registers functional group. 


63 1 0 
SEL — 


RESO 


Figure B2-36 ERRSELR_EL1 bit assignments 


RESO, [63:1] 


Reserved,RESO. 


SEL, [0] 
Selects which error record should be accessed. 


() Select record 0 containing errors from Level | and Level 2 RAMs located on the 
Cortex-A55 core. 


1 Select record | containing errors from Level 3 RAMs located on the DSU. 


Configurations 
ERRSELR_ ELI is architecturally mapped to AArch32 register ERRSELR. See 
B1.31 ERRSELR, Error Record Select Register on page B1-182. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.42 ERXADDR_EL1, Selected Error Record Address Register, EL1 


B2.42 ERXADDR_EL1, Selected Error Record Address Register, EL1 


Register ERXADDR_ ELI accesses the ERR<n>ADDR address register for the error record selected by 
ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXADDR_ EL] accesses the ERROADDR register of the core error 
record. See B3.2 ERROADDR, Error Record Address Register on page B3-468. 


If ERRSELR_EL1.SEL==1, then ERXADDR_ ELI accesses the ERRIADDR register of the DSU error 
record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B2 AArch64 system registers 
B2.43 ERXCTLR_EL1, Selected Error Record Control Register, EL1 


B2.43 ERXCTLR_EL1, Selected Error Record Control Register, EL1 


Register ERXCTLR_ELI accesses the ERR<n>CTLR control register for the error record selected by 
ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXCTLR_EL1 accesses the ERROCTLR register of the core error 
record. See B3.3 ERROCTLR, Error Record Control Register on page B3-469. 


If ERRSELR_EL1.SEL==1, then ERXCLTR_EL] accesses the ERR1ICTLR register of the DSU error 
record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B2 AArch64 system registers 
B2.44 ERXFR_EL1, Selected Error Record Feature Register, EL1 


B2.44 ERXFR_EL1, Selected Error Record Feature Register, EL1 


Register ERXFR_EL1 accesses the ERR<n>FR feature register for the error record selected by 
ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXFR_EL1 accesses the ERROFR register of the core error record. 
See B3.4 ERROFR, Error Record Feature Register on page B3-471. 





If ERRSELR_EL1.SEL==1, then ERXFR_EL1 accesses the ERRIFR register of the DSU error record. 
See the Arm® DynamIO™ Shared Unit Technical Reference Manual. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B2-364 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.45 ERXMISCO_EL1, Selected Error Record Miscellaneous Register 0, EL1 


B2.45 ERXMISCO_EL1, Selected Error Record Miscellaneous Register 0, EL1 


Register ERXMISCO_EL1 accesses the ERR<n>MISCO register for the error record selected by 
ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXMISCO EL] accesses the ERROMISCO register of the core error 
record. See B3.5 ERROMISCO, Error Record Miscellaneous Register 0 on page B3-473. 


If ERRSELR_EL1.SEL==1, then ERXMISCO ELI accesses the ERR1 MISCO register of the DSU error 
record. See the Arm® DynamIOQ™ Shared Unit Technical Reference Manual. 
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B2 AArch64 system registers 
B2.46 ERXMISC1_EL1, Selected Error Record Miscellaneous Register 1, EL1 


B2.46 ERXMISC1_EL1, Selected Error Record Miscellaneous Register 1, EL1 


Register ERXMISC1_EL1 accesses the ERR<n>MISC1 miscellaneous register 1 for the error record 
selected by ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXMISC1_ EL] accesses the ERROMISC1 register of the core error 
record. See B3.6 ERROMISCI, Error Record Miscellaneous Register 1 on page B3-475. 


If ERRSELR_EL1.SEL==1, then ERXMISC1 ELI accesses the ERR1MISC1 register of the DSU error 
record. See the Arm® DynamIOQ™ Shared Unit Technical Reference Manual. 
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B2 AArch64 system registers 
B2.47 ERXPFGCDNR_EL1, Selected Error Pseudo Fault Generation Count Down Register, EL1 


B2.47  ERXPFGCDNR_EL41, Selected Error Pseudo Fault Generation Count Down 
Register, EL1 


Register ERXPFGCDNR_ELI accesses the ERR<n>PFGCNDR register for the error record selected by 
ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXPFGCDNR_ EL] accesses the ERROPFGCDNR register of the 
core error record. See B3.7 ERROPFGCDNR, Error Pseudo Fault Generation Count Down Register 
on page B3-476. 


If ERRSELR_EL1.SEL==1, then ERXPFGCDNR_ELI accesses the ERR1PFGCDNR register of the 
DSU error record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 


Configurations 


ERXPFGCDNR_ ELI is architecturally mapped to AArch32 register ERXPFGCDNR. See 
B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation Count Down Register 
on page B1-193. 


Accessing the ERXPFGCDNR_EL1 
This register can be read using MRS with the following syntax: 
MRS <Xt>,<systemreg> 
This register can be written using MSR with the following syntax: 
MSR <Xt>,<systemreg> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0/o0p1|CRn/|CRm | op2 























$3_0_C15_C2_2}11 | 000 | 1111 | 0010 | 010 





Accessibility 


This register is accessible in software as follows: 





<syntax> Control Accessibility 





E2H |TGE |NS ELO |EL1 |EL2 |EL3 











$3.0 C15 C2 2 x x 0 : RW |n/a |RW 
S30 C15 C22 x 0 1 : RW |RW |RW 
$3.0 C15 C22 x 1 1 2 nwa |RW |RW 


























n/a_ Not accessible. Executing the PE at this Exception level is not permitted. 
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B2 AArch64 system registers 
B2.47 ERXPFGCDNR_EL1, Selected Error Pseudo Fault Generation Count Down Register, EL1 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. Subject to these prioritization rules, the following traps and enables are 
applicable when accessing this register. 


ERXPFGCDNR _ELI is accessible at EL3 and can be accessible at EL1 and EL2 depending on 
the value of bit[5] in ACTLR_EL2 and ACTLR_EL3. See 82.6 ACTLR_EL?2, Auxiliary Control 
Register, EL2 on page B2-305 and B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 

on page B2-307. 


ERXPFGCDNR_ELI is UNDEFINED at ELO. 


If ERXPFGCDNR_ ELI is accessible at EL1 and HCR_EL2.TERR == 1, then direct reads and 
writes of ERXPFGCDNR_EL1 at Non-secure EL! generate a Trap exception to EL2. 


If ERXPFGCDNR_ELI is accessible at EL1 or EL2 and SCR_EL3.TERR == 1, then direct 
reads and writes of ERXPFGCDNR_ELI at EL1 or EL2 generate a Trap exception to EL3. 
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B2 AArch64 system registers 
B2.48 ERXPFGCTLR_EL1, Selected Error Pseudo Fault Generation Control Register, EL1 


ERXPFGCTLR_EL1, Selected Error Pseudo Fault Generation Control 
Register, EL1 


Register ERXPFGCTLR_ELI accesses the ERR<n>PFGCTLR register for the error record selected by 
ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXPFGCTLR_ELI accesses the ERROPFGCTLR register of the core 
error record. See B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control Register 
on page B3-477. 


If ERRSELR_EL1.SEL==1, then ERXPFGCTLR_ ELI accesses the ERR1PFGCTLR register of the 
DSU error record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 


Configurations 


ERXPFGCTLR_ ELI is architecturally mapped to AArch32 register ERXPFGCTLR. See 
B1.43 ERXPFGCTLR, Selected Error Pseudo Fault Generation Control Register 
on page B1-195. 


Accessing the ERXPFGCTLR_EL1 
This register can be read using MRS with the following syntax: 
MRS <Xt>,<systemreg> 
This register can be written using MSR with the following syntax: 
MSR <Xt>,<systemreg> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0/op1|CRn/|CRm | op2 























$3_0 C15_C2_1}11 | 000 | 1111 | 0010 | 001 





Accessibility 


This register is accessible in software as follows: 





<syntax> Control Accessibility 





E2H |TGE |NS ELO |EL1 |EL2 |EL3 











$3.0 C15 C21 x x 0 : RW |n/a |RW 
$3.0 C15 C21 x 0 1 : RW |RW /RW 
§3.0.Cis C2 1 x 1 1 : na |RW |RW 
































'n/a' Not accessible. The PE cannot be executing at this Exception level, so this access is not possible. 
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B2 AArch64 system registers 
B2.48 ERXPFGCTLR_EL1, Selected Error Pseudo Fault Generation Control Register, EL1 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. Subject to these prioritization rules, the following traps and enables are 
applicable when accessing this register. 


ERXPFGCTLR_ELI 1s accessible at EL3 and can be accessible at EL1 and EL2 depending on 
the value of bit[5] in ACTLR_EL2 and ACTLR_EL3. See 82.6 ACTLR_EL?2, Auxiliary Control 
Register, EL2 on page B2-305 and B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 

on page B2-307. 


ERXPFGCTLR_ELI is UNDEFINED at ELO. 


If ERXPFGCTLR_ELI is accessible at EL1 and HCR_EL2.TERR == 1, then direct reads and 
writes of ERXPFGCTLR_EL1 at Non-secure EL1 generate a Trap exception to EL2. 


If ERXPFGCTLR_ ELI is accessible at EL1 or EL2 and SCR_EL3.TERR == 1, then direct 
reads and writes of ERXPFGCTLR_ELI at EL] or EL2 generate a Trap exception to EL3. 
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B2 AArch64 system registers 
B2.49 ERXPFGFR_EL1, Selected Pseudo Fault Generation Feature Register, EL1 


B2.49 ERXPFGFR_EL1, Selected Pseudo Fault Generation Feature Register, EL1 


Register ERXPFGFR_EL1 accesses the ERR<n>PFGFR register for the error record selected by 
ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXPFGFR_EL1 accesses the ERROPFGFR register of the core error 
record. See B3.9 ERROPFGFR, Error Pseudo Fault Generation Feature Register on page B3-479. 


If ERRSELR_EL1.SEL==1, then ERXPFGFR_EL1 accesses the ERRIPFGFR register of the DSU error 
record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 


Configurations 


ERXPFGFR_EL1 is architecturally mapped to AArch32 register ERXPFGFR. See 
B1.44 ERXPFGEFR, Selected Pseudo Fault Generation Feature Register on page B1-196. 


Accessing the ERXPFGFR_EL1 


This register can be read using MRS with the following syntax: 


MRS <Xt>,<systemreg> 


This syntax is encoded with the following settings in the instruction encoding: 





<systemreg> | op0/o0p1|CRn/|CRm | op2 























$3.0 C15 C20] 11 | 000 | 1111 | 0010 | 000 





Accessibility 


This register is accessible in software as follows: 





<syntax> Control Accessibility 





E2H |TGE |NS ELO |EL1 |EL2 |EL3 











$3.0 C15 C20 x x 0 5 RO [nla [RO 
S3_0._C15 C20 x 0 1 : RO |RO [RO 
S3_0._C15 C20 x 1 1 E nia |RO [RO 
































‘n/a’ Not accessible. The PE cannot be executing at this Exception level, so this access is not 
possible. 


Traps and enables 


For a description of the prioritization of any generated exceptions, see Exception priority order 
in the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
exceptions taken to AArch32 state, and see Synchronous exception prioritization for exceptions 
taken to AArch64 state. Subject to these prioritization rules, the following traps and enables are 
applicable when accessing this register. 


ERXPFGR_ELI is accessible at EL3 and can be accessible at EL1 and EL2 depending on the 
value of bit[5] in ACTLR_EL2 and ACTLR_EL3. See 82.6 ACTLR_EL2, Auxiliary Control 
Register, EL2 on page B2-305 and B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 

on page B2-307. 


ERXPFGR_EL] is UNDEFINED at ELO. 


If ERXPFGR_ELI is accessible at EL1 and HCR_EL2.TERR == 1, then direct reads and writes 
of ERXPFGR_EL] at Non-secure EL] generate a Trap exception to EL2. 


If ERXPFGR_ELI is accessible at EL1 or EL2 and SCR_EL3.TERR == 1, then direct reads and 
writes of ERXPFGR_EL1 at EL1 or EL2 generate a Trap exception to EL3. 
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B2 AArch64 system registers 
B2.50 ERXSTATUS_EL1, Selected Error Record Primary Status Register, EL1 


B2.50 ERXSTATUS_EL1, Selected Error Record Primary Status Register, EL1 


Register ERXSTATUS_ ELI accesses the ERR<n>STATUS primary status register for the error record 
selected by ERRSELR_EL1.SEL. 


If ERRSELR_EL1.SEL==0, then ERXSTATUS_ ELI accesses the ERROSTATUS register of the core 
error record. See B3.10 ERROSTATUS, Error Record Primary Status Register on page B3-481. 


If ERRSELR_EL1.SEL==1, then ERXSTATUS_EL]1 accesses the ERRISTATUS register of the DSU 
error record. See the Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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B2 AArch64 system registers 
B2.51 ESR_EL1, Exception Syndrome Register, EL1 


B2.51 ESR_EL1, Exception Syndrome Register, EL1 


The ESR_EL1 holds syndrome information for an exception taken to EL1. 


Bit field descriptions 
ESR_ ELI is a 32-bit register, and is part of the Exception and fault handling registers functional group. 


31 26 25 24 23 0 


|_ISS Valid 
IL 


Figure B2-37 ESR_EL1 bit assignments 


a OP ee Class. Indicates the reason for the exception that this register holds information 
about. 
IL, [25] 
Instruction Length for synchronous exceptions. The possible values are: 
@ 16-bit. 
1 32-bit. 


This field is 1 for the SError interrupt, instruction aborts, misaligned PC, Stack pointer 
misalignment, Data Aborts for which the ISV bit is 8, exceptions caused by an illegal instruction 
set state, and exceptions using the @x@@ Exception Class. 


ISS Valid, [24] 


Syndrome valid. The possible values are: 


e ISS not valid, ISS is reso. 
1 ISS valid. 
ISS, [23:0] 


Syndrome information. 
When the EC field is @x2F, indicating an SError interrupt has occurred, the ISS field contents 
are IMPLEMENTATION DEFINED. 

Configurations 


ESR_ELI is architecturally mapped to AArch32 register DFSR (NS). See B/.28 DFSR, Data 
Fault Status Register on page B1-175. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.52 ESR_EL2, Exception Syndrome Register, EL2 


B2.52 ESR_EL2, Exception Syndrome Register, EL2 


The ESR_EL2 holds syndrome information for an exception taken to EL2. 


Bit field descriptions 
ESR_EL2 is a 32-bit register, and is part of: 


The Virtualization registers functional group. 
The Exception and fault handling registers functional group. 


31 26 25 24 0 
LIL 


Figure B2-38 ESR_EL2 bit assignments 


EC, [31:26] 


IL, [25] 


Exception Class. Indicates the reason for the exception that this register holds information 
about. See the Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile for 
more information. 


Instruction Length for synchronous exceptions. The possible values are: 
@ 16-bit. 
1 32-bit. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for more 
information. 


ISS, [24:0] 


Syndrome information. See the Arm® Architecture Reference Manual Armv8, for Armv8-A 
architecture profile for more information. 


When reporting a virtual SEI, bits[24:0] take the value of VSESRL_EL2[24:0]. 

When reporting a physical SEI, the following occurs: 

« IDS==0 (architectural syndrome). 

« AET always reports an uncontainable error (UC) with value @b@@@ or an unrecoverable error 


(UEU) with value @be01. 
¢ EA is RESO. 


When reporting a synchronous Data Abort, EA is RESo. 
See B2.108 VSESR_EL2, Virtual SError Exception Syndrome Register on page B2-460. 


Configurations 


ESR_EL2 is architecturally mapped to AArch32 register HSR. See B/.57 HSR, Hyp Syndrome 
Register on page B1-212. 


If EL2 is not implemented, this register is Reso from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 





100442 _0200_00 en 


Copyright © 2016-2018 Arm Limited or its affiliates. All rights B2-374 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.53 ESR_EL3, Exception Syndrome Register, EL3 


B2.53 ESR_EL3, Exception Syndrome Register, EL3 


The ESR_EL3 holds syndrome information for an exception taken to EL3. 


Bit field descriptions 
ESR_EL3 is a 32-bit register, and is part of the Exception and fault handling registers functional group. 


31 26 25 24 23 0 


|_ISS Valid 
IL 


Figure B2-39 ESR_EL3 bit assignments 


a OP ee Class. Indicates the reason for the exception that this register holds information 
about. 
IL, [25] 
Instruction Length for synchronous exceptions. The possible values are: 
@ 16-bit. 
1 32-bit. 


This field is 1 for the SError interrupt, instruction aborts, misaligned PC, Stack pointer 
misalignment, data aborts for which the ISV bit is 0, exceptions caused by an illegal instruction 
set state, and exceptions using the @x@ Exception Class. 


ISS Valid, [24] 


Syndrome valid. The possible values are: 


() ISS not valid, ISS is reso. 
1 ISS valid. 
ISS, [23:0] 


Syndrome information. 


When the EC field is @x2F, indicating an SError interrupt has occurred, the ISS field contents 
are IMPLEMENTATION DEFINED. 


Configurations 


ESR_EL3 is mapped to AArch32 register DFSR(S). See B/.28 DF'SR, Data Fault Status 
Register on page B1-175. 


RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.54 HACR_EL2, Hyp Auxiliary Configuration Register, EL2 


B2.54 HACR_EL2, Hyp Auxiliary Configuration Register, EL2 


HACR_EL2 controls trapping to EL2 of IMPLEMENTATION DEFINED aspects of Non-secure EL1 or ELO 
operation. This register is not used in the Cortex-A55 core. 


Bit field descriptions 


HACR_EL2 is a 32-bit register, and is part of Virtualization registers functional group. 


31 0 


ee 


RESO 


Figure B2-40 HACR_EL2 bit assignments 
RESO, [31:0] 


Reserved, RESO. 
Configurations 


AArch64 System register HACR_EL2 is architecturally mapped to AArch32 System register 
HACR. See B/.47 HACR, Hyp Auxiliary Configuration Register on page B1-199. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 


B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 


The HCR_EL2 provides configuration control for virtualization, including whether various Non-secure 


operations are trapped to EL2. 


Bit field descriptions 


HCR_EL2 is a 64-bit register, and is part of the Virtualization registers functional group. 


63 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20191817 161514131211109 8 76543 210 


- 


¢ 
W 





MIOCNCE —! 
TLOR 
E2H 


























ID 
cD 
RW 
TRVM 
HCD 
TDZ —— 
TGE 
TVM ————_ 
TTLB 
TPU ——_4 
TPC 
TSW 
TACR 
TIDCP 
TSC 


RESO 


RES1 


RESO, [63:39] 


RESO Reserved. 


MIOCNCE, [38] 





Cw 
SWIO 
PTW 


















































FMO 
IMO 
AMO 
VF 
Vi 
—— VSE 
FB 
BSU 
DC 
—_—_—_— TWI 
TWE 
TIDO 
TID1 
TID2 
TID3 


Figure B2-41 HCR_EL2 bit assignments 


Mismatched Inner/Outer Cacheable Non-Coherency Enable, for the Non-secure EL1 and ELO 


translation regime. 


This bit is not implemented, RAZ/WI. 





RW, [31] 
Execution state control for lower Exception levels. The possible values are: 
) Lower levels are all AArch32. 
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B2 AArch64 system registers 
B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 


1 The Execution state for EL] is AArch64. The Execution state for ELO is determined 
by the current value of PSTATE.nRW when executing at ELO. 


HCD, [29] 


HVC instruction disable. 


This bit is reserved, RESO. 


TGE, [27] 


Traps general exceptions. If this bit is set, and SCR_EL3.NS is set, then: 

¢ All exceptions that would be routed to EL1 are routed to EL2. 

¢ The SCTLR_ELI.M bit is treated as @ regardless of its actual state, other than for reading the 
bit. 

¢ The HCR_EL2.FMO, IMO, and AMO bits are treated as 1 regardless of their actual state, 
other than for reading the bits. 

¢ All virtual interrupts are disabled. 

¢ Any IMPLEMENTATION DEFINED mechanisms for signaling virtual interrupts are disabled. 

« An exception return to EL! is treated as an illegal exception return. 


HCR_EL2.TGE must not be cached in a TLB. 


When the value of SCR_EL3.NS is 0 the core behaves as if this field is 0 for all purposes other 
than a direct read or write access of HCR_EL2. 


TID3, [18] 


Traps ID group 3 registers. The possible values are: 
7) ID group 3 register accesses are not trapped. 
1 Reads to ID group 3 registers executed from Non-secure EL] are trapped to EL2. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for the 
registers covered by this setting. 


TIDO, [15] 


Trap ID Group 0. When 1, this causes reads to the following registers executed from EL1 or 
ELO if not UNDEFINED to be trapped to EL2: 


FPSID and JIDR. 


When the value of SCR_EL3.NS is @ the PE behaves as if this field is @ for all purposes other 
than a direct read or write access of HCR_EL2. 


SWIO, [1] 


Set/Way Invalidation Override. Non-secure EL1 execution of the data cache invalidate by 
set/way instruction is treated as data cache clean and invalidate by set/way. 


This bit is RES1. 


Configurations 


HCR_EL2[31:0] is architecturally mapped to AArch32 register HCR. See B/.54 HCR, Hyp 
Configuration Register on page B1-207. 


HCR_EL2[63:32] is architecturally mapped to AArch32 register HCR2. See B/.55 HCR2, Hyp 
Configuration Register 2 on page B1-209. 


If EL2 is not implemented, this register is Reso from EL3 
RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.56 HPFAR_EL2, Hypervisor IPA Fault Address Register, EL2 


B2.56 HPFAR_EL2, Hypervisor IPA Fault Address Register, EL2 
The HPFAR_EL2 holds the faulting IPA for some aborts on a stage 2 translation taken to EL2. 


Bit field descriptions 
HPFAR_ EL2 is a 64-bit register, and is part of: 


¢ The Exception and fault handling registers functional group. 
¢ The Virtualization registers functional group. 


40 39 4 3 0 


63 
FIPA[47:12] 


RESO 


Figure B2-42 HPFAR_EL2 bit assignments 
RESO, [63:40] 


RESO Reserved. 


FIPA[47:12], [39:4] 


Bits [47:12] of the faulting intermediate physical address. The equivalent upper bits in this field 
are RESO. 


RESO, [3:0] 
RESO Reserved. 
Configurations 


AArch64 register HPFAR_EL2[31:0] is architecturally mapped to AArch32 register HPFAR. 
See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


If EL2 is not implemented, this register is REso from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.57 ID_AA64DFRO_EL1, AArch64 Debug Feature Register 0, EL1 


B2.57  ID_AAG64DFRO_EL1, AArch64 Debug Feature Register 0, EL1 
Provides top-level information about the debug system in AArché4. 
Bit field descriptions 
ID_AA64DFRO_ ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


63 32 31 28 27 24 23 20 19 1615 12 11 





RESO 


Figure B2-43 ID_AA64DFR0_EL1 bit assignments 


RESO, [63:32] 
RESO Reserved. 
CTX_CMPs, [31:28] 


Number of breakpoints that are context-aware, minus |. These are the highest numbered 
breakpoints: 


@x1 Two breakpoints are context-aware. 
RESO, [27:24] 

RESO Reserved. 
WRPs, [23:20] 

The number of watchpoints minus |: 

@x3 Four watchpoints. 
RESO, [19:16] 

RESO Reserved. 
BRPs, [15:12] 

The number of breakpoints minus |: 

@x5 Six breakpoints. 
PMUVer, [11:8] 

Performance Monitors Extension version. 

ex4 Performance monitor system registers implemented, PMUv3. 
TraceVer, [7:4] 

Trace extension: 

exe Trace system registers not implemented. 
DebugVer, [3:0] 

Debug architecture version: 


@x8 Armv8-A debug architecture implemented. 
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B2 AArch64 system registers 
B2.57 ID_AA64DFRO_EL1, AArch64 Debug Feature Register 0, EL1 


Configurations 


ID_AA64DFRO_EL] is architecturally mapped to external register EDDFR. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.58 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute Register 0, EL1 


B2.58 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute Register 0, EL1 


The ID_AA64ISARO_ EL] provides information about the instructions implemented in AArch64 state, 
including the instructions that are provided by the Cryptographic Extension. 


Bit field descriptions 

ID_AA64ISARO_ ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 

The optional Cryptographic Extension is not included in the base product of the core. Arm requires 


licensees to have contractual rights to obtain the Cryptographic Extension. 


63 48 47 44 43 32 31 28 27 24 23 20 19 16.15 12 


11 8 7 4 3 0 


RESO 


Figure B2-44 ID_AA64ISARO_EL1 bit assignments 
RESO, [63:48] 
RESO Reserved. 
DP, [47:44] 
Indicates whether Dot Product support instructions are implemented. 
@x1 UDOT, SDOT instructions are implemented. 
RESO, [43:32] 
RESO Reserved. 
RDM, [31:28] 
Indicates whether SQRDMLAH and SQRDMLSH instructions in AArch64 are implemented. 
@x1 SQRDMLAH and SQRDMLSH instructions implemented. 
RESO, [27:24] 
RESO Reserved. 
Atomic, [23:20] 
Indicates whether Atomic instructions in AArch64 are implemented. The value is: 


@x2 LDADD, LDCLR, LDEOR, LDSET, LDSMAX, LDSMIN, LDUMAX, LDUMIN, CAS, CASP, and SWP 
instructions are implemented 


CRC32, [19:16] 
Indicates whether CRC32 instructions are implemented. The value is: 
ex1 CRC32 instructions are implemented. 

SHA2, [15:12] 


Indicates whether SHA2 instructions are implemented. The possible values are: 
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B2 AArch64 system registers 
B2.58 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute Register 0, EL1 


exe No SHA2 instructions are implemented. This is the value if the core implementation 
does not include the Cryptographic Extension. 
@x1 SHA256H, SHA256H2, SHA256U@, and SHA256U1 implemented. This is the value if the 
core implementation includes the Cryptographic Extension. 
SHA, [11:8] 
Indicates whether SHA1 instructions are implemented. The possible values are: 
exe No SHA1 instructions implemented. This is the value if the core implementation does 
not include the Cryptographic Extension. 
@x1 SHA1C, SHA1P, SHA1M, SHA1SU®, and SHA1SU1 implemented. This is the value if the 
core implementation includes the Cryptographic Extension. 
AES, [7:4] 
Indicates whether AES instructions are implemented. The possible values are: 
exe No AES instructions implemented. This is the value if the core implementation does 
not include the Cryptographic Extension. 


@x2 AESE, AESD, AESMC, and AESIMC implemented, plus PMULL and PMULL2 instructions 
operating on 64-bit data. This is the value if the core implementation includes the 
Cryptographic Extension. 





[3:0] 
Reserved, RESO. 
Configurations 
ID_AA64ISARO_ EL] is architecturally mapped to external register ID_AA64ISARO. 
Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
100442 0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B2-383 


reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.59 ID_AA64ISAR1_EL1, AArch64 Instruction Set Attribute Register 1, EL1 


B2.59 ID _AA64ISAR1_EL1, AArch64 Instruction Set Attribute Register 1, EL1 
The ID_AA64ISAR1_ EL] provides information about the instructions implemented in AArch6é4 state. 
Bit field descriptions 


ID_AA64ISAR1 ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


63 24.23 20 19 4 3 0 


LRCPC DC CVAP 


RESO 


Figure B2-45 ID_AA64ISAR1_EL1 bit assignments 
RESO, [63:24] 


RESO Reserved. 
LRCPVC, [23:20] 


Indicates whether load-acquire (LDA) instructions are implemented for a Release Consistent core 
consistent RCPC model. 


@x1 The LDAPRB, LDAPRH, and LDAPR instructions are implemented in AArch64. 
RESO, [19:4] 

RESO Reserved. 
DC CVAP, [3:0] 


Indicates whether Data Cache, Clean to the Point of Persistence (DC CVAP) instructions are 


implemented. 
ex1 DC CVAP is supported in AArch64. 
Configurations 


There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2.60 ID_LAA64MMFRO_EL1, AArch64 Memory Model Feature Register 0, EL1 


B2.60 ID_AA64MMFRO_EL1, AArch64 Memory Model Feature Register 0, EL1 


The ID AA64MMFRO ELI provides information about the implemented memory model and memory 
management support in the AArch64 Execution state. 


Bit field descriptions 


ID_AA64MMEFRO ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


63 24 23 20 19 1615 12 11 8 7 4 3 0 
| TGran16 |BigEndELO| SNSMem BigEnd ASIDBits | PARange 





RESO 


Figure B2-46 ID_AA64MMFRO_EL1 bit assignments 

RESO, [63:24] 

RESO Reserved. 
TGran16, [23:20] 

Support for 16KB memory translation granule size: 

@x1 Indicates that the 16KB granule is supported. 
BigEndELO, [19:16] 

Mixed-endian support only at ELO. 

exe No mixed-endian support at ELO. The SCTLR_EL1.E0E bit has a fixed value. 
SNSMem, [15:12] 

Secure versus Non-secure Memory distinction: 

ex1 Supports a distinction between Secure and Non-secure Memory. 
BigEnd, [11:8] 

Mixed-endian configuration support: 


ex1 Mixed-endian support. The SCTLR_ELx.EE and SCTLR_EL1.E0E bits can be 
configured. 


ASIDBits, [7:4] 
Number of ASID bits: 
@x2 16 bits. 
PARange, [3:0] 
Physical address range supported: 
@x2 40 bits, 1TB. 


The supported Physical Address Range is 40-bits. Other cores in the DSU may support 
a different Physical Address Range. 
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B2.60 ID_AA64MMFRO_EL1, AArch64 Memory Model Feature Register 0, EL1 


Configurations 
There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2.61 ID_AA64MMFR1_EL1, AArch64 Memory Model Feature Register 1, EL1 


B2.61 ID _AA64MMFR1_EL1, AArch64 Memory Model Feature Register 1, EL1 


The ID AA64MMFRI ELI provides information about the implemented memory model and memory 
management support in the AArch64 Execution state. 


Bit field descriptions 
ID_AA64MMERI ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


32 31 28 27 24 23 20 19 1615 12 11 


RESO 


4.3 0 
VMID HAFDBS 





Figure B2-47 ID_AA64MMFR1_EL1 bit assignments 
RESO, [63:32] 
RESO Reserved. 
XNX, [31:28] 
Indicates whether provision of ELO vs EL1 execute never control at Stage 2 is supported. 


@x1 ELO/EL1 execute control distinction at Stage 2 bit is supported. All other values are 
reserved. 


RESO, [27:24] 
RESO Reserved. 
PAN, [23:20] 


Privileged Access Never. Indicates support for the PAN bit in PSTATE, SPSR_EL1, SPSR_EL2, 
SPSR_EL3, and DSPSR_ELO. 


@x2 PAN supported and AT SIEIRP and AT S1E1WP instructions supported. 
LO, [19:16] 
Indicates support for LORegions. 


@x1 
LORegions are supported. 


HD, [15:12] 
Presence of Hierarchical Disables. Enables an operating system or hypervisor to hand over up to 


4 bits of the last level page table descriptor (bits[62:59] of the page table entry) for use by 
hardware for IMPLEMENTATION DEFINED usage. The value is: 





@x2 Hierarchical Permission Disables and Hardware allocation of bits[62:59] supported. 
VH, [11:8] 
Indicates whether Virtualization Host Extensions are supported. 
@x1 Virtualization Host Extensions supported. 
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VMID, [7:4] 
Indicates the number of VMID bits supported. 


@x2 16 bits are supported. 


HAFDBS, [3:0] 
Indicates the support for hardware updates to Access flag and dirty state in translation tables. 


@x2 Hardware update of both the Access flag and dirty state is supported in hardware. 


Configurations 
There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.62 ID_AA64MMFR2_EL1, AArch64 Memory Model Feature Register 2, EL1 


B2.62 ID _AA64MMFR2_EL1, AArch64 Memory Model Feature Register 2, EL1 


The ID AA64MMFR2_ ELI provides information about the implemented memory model and memory 
management support in the AArch64 Execution state. 


Bit field descriptions 


ID_AA64MMFR2 ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


63 1615 12 11 8 


7 4 3 0 








RESO 
Figure B2-48 ID_AA64MMFR2_EL1 bit assignments 
RESO, [63:16] 
RESO Reserved. 
IESB, [15:12] 
Indicates whether an implicit Error Synchronization Barrier has been inserted. The value is: 
ex1 SCTLR_ELx.IESB implicit ErrorSynchronizationBarrier control implemented. 
LSM, [11:8] 
Indicates whether LDM and STM ordering control bits are supported. The value is: 
@xe LSMAOE and nTLSMD bit not supported. 
UAO, [7:4] 
Indicates the presence of the User Access Override (UAO). The value is: 
@x1 UAO is supported. 
CnP, [3:0] 
Common not Private. Indicates whether a TLB entry is pointed at a translation table base 
register that is a member of a common set. The value is: 
@x1 CnP bit is supported. 
Configurations 
There are no configuration notes. 
Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2.63 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 0, EL1 


B2.63 ID _AA64PFRO_EL1, AArch64 Processor Feature Register 0, EL1 
The ID_AA64PFRO EL] provides additional information about implemented core features in AArch64. 


The optional Advanced SIMD and floating-point support is not included in the base product of the core. 
Arm requires licensees to have contractual rights to obtain the Advanced SIMD and floating-point 
support. 


Bit field descriptions 


ID_AA64PFRO_ ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


63 60 59 56 55 32 31 28 27 24 23 20 19 16 15 1211 8 7 4 3 0 
EL3 EL2 EL1 ELO 
Se pove BevAlND handling handling handling handling 
RESO 


Figure B2-49 ID_AA64PFRO0_EL1 bit assignments 
CSV3, [63:60] 


exe Data loaded under speculation with a permission or domain fault cannot be used to 
form an address or generate condition codes to be used by instructions newer than the 
load in the speculative sequence. This is the reset value. 


All other values reserved. 


CSV2, [59:56] 


exe Branch targets trained in one context cannot affect speculative execution in a different 
hardware described context. This is the reset value. 


All other values reserved. 
RESO, [55:32] 
RESO Reserved. 
RAS, [31:28] 
RAS extension version. The possible values are: 


@x1 Version | of the RAS extension is present. 


GIC, [27:24] 

GIC CPU interface: 

@x® GIC CPU interface is disabled, GICCDISABLE is HIGH, or not implemented. 

ex1 GIC CPU interface is implemented and enabled, GICCDISABLE is LOW. 
AdvSIMD, [23:20] 

Advanced SIMD. The possible values are: 

@x1 Advanced SIMD, including Half-precision support, is implemented. 

@xF Advanced SIMD is not implemented. 


The FP and AdvSIMD both take the same value, as both must be implemented, or neither. 
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B2.63 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 0, EL1 


FP, [19:16] 
Floating-point. The possible values are: 
ex1 Floating-point, including Half-precision support, is implemented. 
@xF Floating-point is not implemented. 


The FP and AdvSIMD both take the same value, as both must be implemented, or neither. 
EL3 handling, [15:12] 

EL3 exception handling: 

@x2 Instructions can be executed at EL3 in AArch64 or AArch32 state. 
EL2 handling, [11:8] 

EL2 exception handling: 

@x2 Instructions can be executed at EL3 in AArch64 or AArch32 state. 
EL1 handling, [7:4] 

ELI exception handling. The possible values are: 

@x2 Instructions can be executed at EL3 in AArch64 or AArch32 state. 
ELO handling, [3:0] 

ELO exception handling. The possible values are: 

@x2 Instructions can be executed at ELO in AArch64 or AArch32 state. 
Configurations 

ID_AA64PFRO_EL1 is architecturally mapped to External register EDPFR. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2.64 ID _AA64PFR1_EL1, AArch64 Processor Feature Register 1, EL1 
The ID_AA64PFRI EL] provides additional information about implemented core features in AArch64. 
Bit field descriptions 


ID_AA64PFRI_ ELI is a 64-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


63 8 7 


PSTATE.SSBS a 


RESO 
Figure B2-50 ID_AA64PFR1_EL1 bit assignments 
RESO, [63:8] 
RESO Reserved. 
SSBS, [7:4] 
AArch64 provides the PSTATE.SSBS mechanism to mark regions that are Speculative Store 
Bypassing Safe (SSBS). 
@x01 
AArch64 provides the PSTATE.SSBS mechanism to mark regions that are Speculative 
Store Bypassing Safe, but does not implement the MSR/MRS instructions to directly 
read and write the PSTATE.SSBS field. 
RESO, [3:0] 
RESO Reserved. 
Configurations 


There are no configuration notes. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2.65 ID_AFRO_EL1, AArch32 Auxiliary Feature Register 0, EL1 


The ID_AFRO_ ELI provides information about the IMPLEMENTATION DEFINED features of the PE in 
AArch32. This register is not used in the Cortex-A55 core. 


Bit field descriptions 


ID_AFRO_ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 0 
RESO 
Figure B2-51 ID_AFRO_EL1 bit assignments 
RESO, [31:0] 
Reserved, RESO. 
Configurations 


AArch64 System register ID AFRO EL] is architecturally mapped to AArch32 System register 
ID_AFRO. See B/.59 ID_AFRO, Auxiliary Feature Register 0 on page B1-215. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.66 ID_DFRO_EL1, AArch32 Debug Feature Register 0, EL1 


ID_DFRO_EL1, AArch32 Debug Feature Register 0, EL1 


The ID_DFRO_ ELI provides top-level information about the debug system in AArch32. 


Bit field descriptions 
ID_DFRO_ EL] is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


RESO 


Figure B2-52 ID_DFRO_EL1 bit assignments 
RESO, [31:28] 
RESO Reserved. 
PerfMon, [27:24] 
Indicates support for performance monitor model: 


4 Support for Performance Monitor Unit version 3 (PMUv3) system registers, with a 
16-bit evtCount field. 


MProfDbg, [23:20] 
Indicates support for memory-mapped debug model for M profile cores: 
) This product does not support M profile Debug architecture. 
MMapTre, [19:16] 
Indicates support for memory-mapped trace model: 
1 Support for Arm trace architecture, with memory-mapped access. 
In the Trace registers, the ETMIDR gives more information about the implementation. 
CopTre, [15:12] 
Indicates support for coprocessor-based trace model: 
) This product does not support Arm trace architecture. 
RESO, [11:8] 
RESO Reserved. 
CopSDbg, [7:4] 
Indicates support for coprocessor-based Secure debug model: 
8 This product supports the Armv8.2 Debug architecture. 
CopDbg, [3:0] 
Indicates support for coprocessor-based debug model: 


8 This product supports the Armv8.2 Debug architecture. 
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B2 AArch64 system registers 
B2.66 ID_DFRO_EL1, AArch32 Debug Feature Register 0, EL1 


Configurations 


ID_DFRO_EL1 is architecturally mapped to AArch32 register ID_DFRO. See B/.60 ID_DFRO, 
Debug Feature Register 0 on page B1-216. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.67 ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, EL1 


ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, EL1 


The ID_ISARO_ ELI provides information about the instruction sets implemented by the core in 
AArch32. 


Bit field descriptions 
ID_ISARO_ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 28 27 24 23 20 19 1615 12 11 8 7 4 3 0 





RESO 


Figure B2-53 ID_ISARO_EL1 bit assignments 

RESO, [31:28] 

RESO Reserved. 
Divide, [27:24] 

Indicates the implemented Divide instructions: 

@x2 * SDIV and UDIV in the T32 instruction set. 

¢ SDIV and UDIV in the A32 instruction set. 

Debug, [23:20] 

Indicates the implemented Debug instructions: 


@x1 BKPT. 


Coproc, [19:16] 
Indicates the implemented Coprocessor instructions: 


exe None implemented, except for instructions separately attributed by the architecture to 
provide access to AArch32 System registers and System instructions. 


CmpBranch, [15:12] 


Indicates the implemented combined Compare and Branch instructions in the T32 instruction 
set: 


6x1 CBNZ and CBZ. 
Bitfield, [11:8] 
Indicates the implemented bit field instructions: 
ex1 BFC, BFI, SBFX, and UBFX. 
BitCount, [7:4] 
Indicates the implemented Bit Counting instructions: 


@x1 CLZ. 
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B2.67 ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, EL1 


Swap, [3:0] 


Indicates the implemented Swap instructions in the A32 instruction set: 


@xe None implemented. 


Configurations 


ID_ISARO_EL1 is architecturally mapped to AArch32 register ID_ISARO. See 
B1.61 ID_ISARO, Instruction Set Attribute Register 0 on page B1-218. 


In an AArch64-only implementation, this register is UNKNOWN. 


Must be interpreted with ID ISAR1_EL1,ID_ISAR2_ EL1,ID ISAR3 EL1, ID ISAR4 EL], 
and ID_ISARS ELI. See: 

¢ B2.68ID_ISARI_ ELI, AArch32 Instruction Set Attribute Register 1, EL1 on page B2-398. 
¢ B2.69ID_ISAR2_ EL1, AArch32 Instruction Set Attribute Register 2, ELI on page B2-400. 
¢ B2.70 ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, EL1 on page B2-402. 
¢ B2.71 ID_ISAR4 ELI, AArch32 Instruction Set Attribute Register 4, EL1 on page B2-404. 
¢ B2.72 ID_ISARS_EL1, AArch32 Instruction Set Attribute Register 5, ELI on page B2-406. 





Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.68 ID_ISAR1_EL1, AArch32 Instruction Set Attribute Register 1, EL1 





B2.68 ID_ISAR1_EL1, AArch32 Instruction Set Attribute Register 1, EL1 
The ID_ISAR1_ EL] provides information about the instruction sets implemented by the core in 
AArch32. 
Bit field descriptions 
ID_ISAR1_ ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 
28 27 24 23 20 19 16 15 12 11 
Figure B2-54 ID_ISAR1_EL1 bit assignments 
Jazelle, [31:28] 
Indicates the implemented Jazelle state instructions: 
@x1 Adds the BXJ instruction, and the J bit in the PSR. 
Interwork, [27:24] 
Indicates the implemented Interworking instructions: 
x3 ¢ The BX instruction, and the T bit in the PSR. 
¢ The BLX instruction. The PC loads have Bx-like behavior. 
¢ Data-processing instructions in the A32 instruction set with the PC as the 
destination and the S bit clear, have Bx-like behavior. 
Immediate, [23:20] 
Indicates the implemented data-processing instructions with long immediates: 
@x1 ¢ The MOVT instruction. 
¢ The MOV instruction encodings with zero-extended 16-bit immediates. 
¢ The T32 ADD and SUB instruction encodings with zero-extended 12-bit immediates, 
and other ADD, ADR, and SUB encodings cross-referenced by the pseudocode for 
those encodings. 
IfThen, [19:16] 
Indicates the implemented If-Then instructions in the T32 instruction set: 
@x1 The IT instructions, and the IT bits in the PSRs. 
Extend, [15:12] 
Indicates the implemented Extend instructions: 
@x2 ¢ The SXTB, SXTH, UXTB, and UXTH instructions. 
¢ The SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, UXTAB16, and UXTAH 
instructions. 
Except_AR, [11:8] 
Indicates the implemented A profile exception-handling instructions: 
ex1 The SRS and RFE instructions, and the A profile forms of the CPS instruction. 
Except, [7:4] 
Indicates the implemented exception-handling instructions in the A32 instruction set: 
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B2 AArch64 system registers 
B2.68 ID_ISAR1_EL1, AArch32 Instruction Set Attribute Register 1, EL1 


@x1 The LDM (exception return), LDM (user registers), and STM (user registers) instruction 
versions. 


Endian, [3:0] 


Indicates the implemented Endian instructions: 


@x1 The SETEND instruction, and the E bit in the PSRs. 


Configurations 


ID_ISAR1_ ELI is architecturally mapped to AArch32 register ID_ISAR1. See 
B1.62 ID_ISARI1, Instruction Set Attribute Register 1 on page B1-220. 


In an AArch64-only implementation, this register is UNKNOWN. 


Must be interpreted with ID ISARO_ EL1,ID_ISAR2 EL1, ID ISAR3 EL1,ID ISAR4 EL] 
and ID_ISARS ELI. See: 

¢ B2.67 ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, ELI on page B2-396. 
¢ B2.69ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 2, EL1 on page B2-400. 
¢ B2.70 ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, EL1 on page B2-402. 
¢ B2.71 ID_ISAR4 ELI, AArch32 Instruction Set Attribute Register 4, EL1 on page B2-404. 
¢ B2.72 ID_ISARS_EL1, AArch32 Instruction Set Attribute Register 5, EL1 on page B2-406. 





Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2.69 ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 2, EL1 


B2.69 ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 2, EL1 


The ID_ISAR2_ ELI provides information about the instruction sets implemented by the core in 
AArch32. 


Bit field descriptions 
ID_ISAR2 ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


MultiAccessint — 


Figure B2-55 ID_ISAR2_EL1 bit assignments 
Reversal, [31:28] 
Indicates the implemented Reversal instructions: 


@x2 The REV, REV16, REVSH, and RBIT instructions. 


PSR_AR, [27:24] 
Indicates the implemented A and R profile instructions to manipulate the PSR: 


ex1 The MRS and MSR instructions, and the exception return forms of data-processing 
instructions. 


The exception return forms of the data-processing instructions are: 


¢ Inthe A32 instruction set, data-processing instructions with the PC as the destination and the 
S bit set. 
¢ Inthe T32 instruction set, the SUBSPC, LR, #N instruction. 


MultU, [23:20] 
Indicates the implemented advanced unsigned Multiply instructions: 


@x2 The UMULL, UMLAL, and UMAAL instructions. 


Mult, [19:16] 
Indicates the implemented advanced signed Multiply instructions. 


@x3 ¢ The SMULL and SMLAL instructions. 
¢ The SMLABB, SMLABT, SMLALBB, SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, 
SMLAWB, SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT instructions, 
and the Q bit in the PSRs. 
* The SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, 
SMMLAR, SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDX 
instructions. 


Mult, [15:12] 
Indicates the implemented additional Multiply instructions: 


@x2 The MUL, MLA and MLS instructions. 


MultiAccessInt, [11:8] 


Indicates the support for interruptible multi-access instructions: 
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exe No support. This means the LDM and STM instructions are not interruptible. 


MemHint, [7:4] 
Indicates the implemented memory hint instructions: 


@x4 The PLD, PLI, and PLDWinstructions. 


LoadStore, [3:0] 
Indicates the implemented additional load/store instructions: 
@x2 The LDRD and STRD instructions. 


The Load Acquire (LDAB, LDAH, LDA, LDAEXB, LDAEXH, LDAEX, and LDAEXD) and Store 
Release (STLB, STLH, STL, STLEXB, STLEXH, STLEX, and STLEXD) instructions. 


Configurations 


ID_ISAR2_ ELI is architecturally mapped to AArch32 register ID_ISAR2. See 
B1.63 ID_ISAR2, Instruction Set Attribute Register 2 on page B1-222. 


In an AArch64-only implementation, this register is UNKNOWN. 


Must be interpreted with ID ISARO EL1,ID_ ISAR1 ELI, ID _ISAR3 EL1,ID_ISAR4 ELI, 
and ID_ISARS ELI. See: 

¢ B2.67 ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, EL1 on page B2-396. 
¢ B2.68 ID_ISARI_EL1, AArch32 Instruction Set Attribute Register 1, EL1 on page B2-398. 
¢ B2.70 ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, EL1 on page B2-402. 
¢ B2.71 ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4, EL1 on page B2-404. 
¢ B2.72ID_ISARS ELI, AArch32 Instruction Set Attribute Register 5, EL1 on page B2-406. 





Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, EL1 


The ID_ISAR3_ELI1 provides information about the instruction sets implemented by the core in 
AArch32. 


Bit field descriptions 
ID_ISAR3_ ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


T32EE TrueNOP | T32Copy | TabBranch cee ral SIMD 


Figure B2-56 ID_ISAR3_EL1 bit assignments 
T32EE, [31:28] 
Indicates the implemented T32EE instructions: 
exe None implemented. 
TrueNOP, [27:24] 
Indicates support for True NOP instructions: 


@x1 True NOP instructions in both the A32 and T32 instruction sets, and additional NOP- 
compatible hints. 


T32Copy, [23:20] 
Indicates the support for T32 non flag-setting MOV instructions: 


ex1 Support for T32 instruction set encoding T1 of the MOV (register) instruction, copying 
from a low register to a low register. 


TabBranch, [19:16] 
Indicates the implemented Table Branch instructions in the T32 instruction set. 
ex1 The TBB and TBH instructions. 

SynchPrim, [15:12] 
Indicates the implemented Synchronization Primitive instructions: 


@x2 ¢ The LDREX and STREX instructions. 
« The CLREX, LDREXB, STREXB, and STREXH instructions. 
¢ The LDREXD and STREXD instructions. 


SVC, [11:8] 
Indicates the implemented SVC instructions: 


@x1 The SVC instruction. 
SIMD, [7:4] 


Indicates the implemented Single Instruction Multiple Data (SIMD) instructions. 
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@x3 ¢ The SSAT and USAT instructions, and the Q bit in the PSRs. 
* The PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, QSUB8, QSAX, SADD16, SADD8, 
SASX, SEL, SHADD16, SHADD8, SHASX, SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, 
SSUB8, SSAX, SXTAB16, SXTB16, UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, 
UHSUB16, UHSUB8, UHSAX, UQADD16, UQADD8, UQASX, UQSUB16, UQSUB8, UQSAX, 
USAD8, USADA8, USAT16, USUB16, USUB8, USAX, UXTAB16, UXTB16 instructions, and 
the GE[3:0] bits in the PSRs. 


The SIMD field relates only to implemented instructions that perform SIMD 
operations on the general-purpose registers. In an implementation that supports 
Advanced SIMD and floating-point instructions, MVFRO, MVFRI1, and MVFR2 give 
information about the implemented Advanced SIMD instructions. 


Saturate, [3:0] 


Indicates the implemented Saturate instructions: 


ex1 The QADD, QDADD, QDSUB, QSUB Q bit in the PSRs. 


Configurations 


ID_ISAR3_EL1 is architecturally mapped to AArch32 register ID_ISAR3. See 
B1.64 ID_ISAR3, Instruction Set Attribute Register 3 on page B1-224. 


In an AArch64-only implementation, this register is UNKNOWN. 


Must be interpreted with ID ISARO_EL1,ID ISARI EL1,ID ISAR2 EL1, ID ISAR4 EL1, 
and ID_ISARS ELI. See: 

¢ B2.67ID_ISARO_ ELI, AArch32 Instruction Set Attribute Register 0, EL1 on page B2-396. 
¢ B2.68ID_ISARI_ ELI, AArch32 Instruction Set Attribute Register 1, EL1 on page B2-398. 
¢ B2.69 ID ISAR2 ELI, AArch32 Instruction Set Attribute Register 2, EL1 on page B2-400. 
¢ B2.71 ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4, ELI on page B2-404. 
¢ B2.72 ID_ISARS ELI, AArch32 Instruction Set Attribute Register 5, EL1 on page B2-406. 





Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2.71  ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4, EL1 
The ID_ISAR4 EL] provides information about the instruction sets implemented by the core in 
AArch32. 
Bit field descriptions 
ID_ISAR4 ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 
28 27 24 23 20 19 16 15 12 11 
nd 
SynchPrim_frac a 
Figure B2-57 ID_ISAR4_EL1 bit assignments 

SWP_ frac, [31:28] 

Indicates support for the memory system locking the bus for SWP or SWPB instructions: 

exe SWP and SWPB instructions not implemented. 
PSR_M, [27:24] 

Indicates the implemented M profile instructions to modify the PSRs: 

exe None implemented. 
SynchPrim_frac, [23:20] 

This field is used with the ID ISAR3.SynchPrim field to indicate the implemented 

Synchronization Primitive instructions: 

exe ¢ The LDREX and STREX instructions. 

¢ The CLREX, LDREXB, LDREXH, STREXB, and STREXH instructions. 
¢ The LDREXD and STREXD instructions. 

Barrier, [19:16] 

Indicates the supported Barrier instructions in the A32 and T32 instruction sets: 

@x1 The DMB, DSB, and ISB barrier instructions. 
SMC, [15:12] 

Indicates the implemented SMC instructions: 

ex1 The SMC instruction. 
WriteBack, [11:8] 

Indicates the support for Write-Back addressing modes: 

ex1 Core supports all the Write-Back addressing modes as defined in Armv8-A. 
WithShifts, [7:4] 

Indicates the support for instructions with shifts. 

100442 0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B2-404 


reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.71 ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4, EL1 


@x4 ¢ Support for shifts of loads and stores over the range LSL 0-3. 
¢ Support for other constant shift options, both on load/store and other instructions. 
¢ Support for register-controlled shift options. 


Unpriv, [3:0] 
Indicates the implemented unprivileged instructions. 


@x2 ¢ The LDRBT, LDRT, STRBT, and STRT instructions. 
¢ The LDRHT, LDRSBT, LDRSHT, and STRHT instructions. 


Configurations 


ID_ISAR4 ELI is architecturally mapped to AArch32 register ID_ISAR4. See 
B1.65 ID_ISAR4, Instruction Set Attribute Register 4 on page B1-226. 


In an AArch64-only implementation, this register is UNKNOWN. 


Must be interpreted with ID ISARO_EL1,ID ISARI EL1,ID ISAR2 EL1, ID ISAR3 ELI, 
and ID_ISARS ELI. See: 

¢ B2.67ID_ISARO_ELI, AArch32 Instruction Set Attribute Register 0, ELI on page B2-396. 
¢ B2.68 ID_ISARI_EL1, AArch32 Instruction Set Attribute Register 1, ELI on page B2-398. 
¢ B2.69ID ISAR2 ELI, AArch32 Instruction Set Attribute Register 2, ELI on page B2-400. 
¢ B2.70ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, ELI on page B2-402. 
¢ B2.72 ID_ISARS_EL1, AArch32 Instruction Set Attribute Register 5, ELI on page B2-406. 





Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2.72 ID_ISAR5_EL1, AArch32 Instruction Set Attribute Register 5, EL1 


The ID ISAR5_ EL] provides information about the instruction sets that the core implements. 


The optional Advanced SIMD and floating-point support is not included in the base product of the core. 


Arm requires licensees to have contractual rights to obtain the Advanced SIMD and floating-point 
support. 


Bit field descriptions 


ID_ISARS_ ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 16 15 12 11 


RESO 


Figure B2-58 ID_ISAR5_EL1 bit assignments 

[31:28] 

RESO Reserved. 
RDM, [27:24] 

VQRDMLAH and VQRDMLSH instructions in AArch32. The value is: 

@x1 VQRDMLAH and VQRDMLSH instructions are implemented. 
[23:20] 

RESO Reserved. 
CRC32, [19:16] 

Indicates whether CRC32 instructions are implemented in AArch32 state. The value is: 


6x1 CRC32B, CRC32H, CRC32W, CRC32CB, CRC32CH, and CRC32CW instructions are 
implemented. 


SHA2, [15:12] 


Indicates whether SHA2 instructions are implemented in AArch32 state. The possible values 
are: 


@x® No SHA2 instructions implemented. This is the value when the Cryptographic 
Extensions are not implemented or are disabled. 
@x1 SHA256H, SHA256H2, SHA256SU@, and SHA256SU1 instructions are implemented. This is 
the value when the Cryptographic Extensions are implemented and enabled. 
SHAL1, [11:8] 


Indicates whether SHA1 instructions are implemented in AArch32 state. The possible values 
are: 


@x® No SHA1 instructions implemented. This is the value when the Cryptographic 
Extensions are not implemented or are disabled. 
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@x1 SHA1C, SHA1P, SHA1M, SHAH, SHA1SU@, and SHA1SU1 instructions are implemented. 
This is the value when the Cryptographic Extensions are implemented and enabled. 


AES, [7:4] 
Indicates whether AES instructions are implemented in AArch32 state. The possible values are: 


@x® No AES instructions implemented. This is the value when the Cryptographic 
Extensions are not implemented or are disabled. 


@x2 ¢ AESE, AESD, AESMC, and AESIMC implemented. 
* PMULL and PMULL2 instructions operating on 64-bit data. 


This is the value when the Cryptographic Extensions are implemented and enabled. 


SEVL, [3:0] 
Indicates whether the SEVL instruction is implemented: 


ex1 SEVL implemented to send event local. 


Configurations 


ID_ISARS5_ ELI is architecturally mapped to AArch32 register ID_ISARS. See 
B1.66 ID_ISARS, Instruction Set Attribute Register 5 on page B1-228. 


ID_ISARS5 must be interpreted with ID ISARO ELI, ID ISAR1_ EL1, ID ISAR2 ELI, 
ID_ISAR3 ELI, and ID_ISAR4 ELI. See: 

¢ B2.67ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0, EL] on page B2-396. 
¢ B2.68ID_ISARI_ ELI, AArch32 Instruction Set Attribute Register 1, EL] on page B2-398. 
¢ B2.69ID ISAR2 ELI, AArch32 Instruction Set Attribute Register 2, EL] on page B2-400. 
¢ B2.70ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3, EL1 on page B2-402. 
¢ B2.71 ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4, EL1 on page B2-404. 





Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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ID_ISAR6_EL1, AArch32 Instruction Set Attribute Register 6, EL1 


The ID ISAR6_EL!1 provides information about the instruction sets that the core implements. 


Bit field descriptions 
ID_ISAR6_ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 8 7 4 3 0 


RESO 


Figure B2-59 ID_ISAR6_EL1 bit assignments 
RESO, [31:8] 


RESO Reserved. 
DP, [7:4] 
UDOT and SDOT instructions. The value is: 


@beee1 UDOT and SDOT instructions are implemented. 


RESO, [3:0] 


RESO Reserved. 


Configurations 


ID_ISAR6_EL1 is architecturally mapped to AArch32 register ID_ISAR6. See 
B1.67 ID_ISAR6, Instruction Set Attribute Register 6 on page B1-230. 


There is one copy of this register that is used in both Secure and Non-secure states. 


ID_ISAR6_EL1 must be interpreted with ID ISARO EL1,ID ISARI EL1,ID ISAR2 ELI, 
ID_ISAR3_ EL1, ID ISAR4 ELI, andID_ISARS5 ELI. See: 

¢ B2.67ID_ISARO_ ELI, AArch32 Instruction Set Attribute Register 0, ELI on page B2-396. 
¢ B2.68ID_ISARI ELI, AArch32 Instruction Set Attribute Register 1, EL1 on page B2-398. 
¢ B2.69 ID ISAR2 ELI, AArch32 Instruction Set Attribute Register 2, EL1 on page B2-400. 
¢ B2.70ID_ISAR3 ELI, AArch32 Instruction Set Attribute Register 3, EL1 on page B2-402. 
¢ B2.71 ID_ISAR4 ELI, AArch32 Instruction Set Attribute Register 4, EL1 on page B2-404. 
¢ B2.72 ID_ISAR5 ELI, AArch32 Instruction Set Attribute Register 5, EL1 on page B2-406. 











Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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ID_MMFRO_EL1, AArch32 Memory Model Feature Register 0, EL1 


The ID MMFRO_ ELI provides information about the memory model and memory management support 
in AArch32. 


Bit field descriptions 
ID_MMFRO EL] is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


Fos jason | Tom | sharetwi | outershr | eMsa | VMSA 


Figure B2-60 ID_MMFRO_EL1 bit assignments 

InnerShr, [31:28] 

Indicates the innermost shareability domain implemented: 

@x1 Implemented with hardware coherency support. 
FCSE, [27:24] 

Indicates support for Fast Context Switch Extension (FCSE): 

exe Not supported. 
AuxReg, [23:20] 

Indicates support for Auxiliary registers: 


@x2 Support for Auxiliary Fault Status Registers (AIFSR and ADFSR) and Auxiliary 
Control Register. 


TCM, [19:16] 
Indicates support for TCMs and associated DMAs: 
exe Not supported. 
ShareLvl, [15:12] 
Indicates the number of shareability levels implemented: 
@x1 Two levels of shareability implemented. 
OuterShr, [11:8] 
Indicates the outermost shareability domain implemented: 
@x1 Implemented with hardware coherency support. 
PMSA, [7:4] 
Indicates support for a Protected Memory System Architecture (PMSA): 
exe Not supported. 
VMSA, [3:0] 
Indicates support for a Virtual Memory System Architecture (VMSA). 
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@x5 Support for: 
« VMSAv7, with support for remapping and the Access flag. 
¢ The PXN bit in the Short-descriptor translation table format descriptors. 
¢ The Long-descriptor translation table format. 
Configurations 


ID_MMFRO ELI is architecturally mapped to AArch32 register ID_ MMFRO. See 
B1.68 ID_MMFRO, Memory Model Feature Register 0 on page B1-231. 


Must be interpreted with ID MMFRI1_EL1, ID MMFR2 ELI, ID MMFR3_ ELI, and 
ID_MMFR4 ELI. See: 


B2.75 ID_MMFR1_EL1, AArch32 Memory Model Feature Register 1, EL1 on page B2-411. 
B2.76 ID_MMFR2_EL1, AArch32 Memory Model Feature Register 2, ELI on page B2-413. 
B2.77 ID_MMFR3_EL1, AArch32 Memory Model Feature Register 3, ELI on page B2-415. 
B2.78 ID_MMFR4_EL1, AArch32 Memory Model Feature Register 4, ELI on page B2-417. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2.75 ID _MMFR1_EL1, AArch32 Memory Model Feature Register 1, EL1 
The ID MMFRI1_ ELI provides information about the memory model and memory management support 
in AArch32. 
Bit field descriptions 
ID_MMEFRI1 EL] is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 
28 27 24 23 20 19 16 15 12 11 
Figure B2-61 ID_MMFR1_EL1 bit assignments 
BPred, [31:28] 
Indicates branch predictor management requirements: 
x4 For execution correctness, branch predictor requires no flushing at any time. 
L1TstCln, [27:24] 
Indicates the supported L1 Data cache test and clean operations, for Harvard or unified cache 
implementation: 
exe None supported. 
L1Uni, [23:20] 
Indicates the supported entire L1 cache maintenance operations, for a unified cache 
implementation: 
exe None supported. 
L1Hvd, [19:16] 
Indicates the supported entire L1 cache maintenance operations, for a Harvard cache 
implementation: 
exe None supported. 
L1UniSW, [15:12] 
Indicates the supported L1 cache line maintenance operations by set/way, for a unified cache 
implementation: 
@xe None supported. 
L1HvdSW, [11:8] 
Indicates the supported L1 cache line maintenance operations by set/way, for a Harvard cache 
implementation: 
@xe None supported. 
L1UniVA, [7:4] 
Indicates the supported L1 cache line maintenance operations by MVA, for a unified cache 
implementation: 
exe None supported. 
L1HvdVA, [3:0] 
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Indicates the supported L1 cache line maintenance operations by MVA, for a Harvard cache 
implementation: 


exe None supported. 


Configurations 


ID_MMEFRI ELI is architecturally mapped to AArch32 register ID MMFRI. See 
B1.69 ID_MMFRI1, Memory Model Feature Register 1 on page B1-233. 


Must be interpreted with ID MMFRO_EL1, ID MMFR2 ELI, ID MMFR3_EL1, and 
ID_MMFR4 ELI. See: 

¢ B2.74ID_MMFRO_ELI, AArch32 Memory Model Feature Register 0, ELI on page B2-409. 
¢ B2.76 ID _MMFR2 ELI, AArch32 Memory Model Feature Register 2, ELI] on page B2-413. 
¢ B2.77 ID _MMFR3_ELI1, AArch32 Memory Model Feature Register 3, EL] on page B2-415. 
¢ B2.78 ID _MMFR4_ ELI, AArch32 Memory Model Feature Register 4, EL] on page B2-417. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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ID_MMFR2_EL1, AArch32 Memory Model Feature Register 2, EL1 


The ID MMFR2_ ELI provides information about the implemented memory model and memory 
management support in AArch32. 


Bit field descriptions 
ID_MMFR2 EL] is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


28 27 24 23 20 19 1615 12 11 


HWAccFlg | WFIStall UniTLB HvdTLB |LL1HvdRng| L1HvdBG | L1HvdFG 


Figure B2-62 ID_MMFR2_EL1 bit assignments 
HWaAccFig, [31:28] 


Hardware access flag. Indicates support for a hardware access flag, as part of the VMSAv7 
implementation: 


exe Not supported. 


WFIStall, [27:24] 
Wait For Interrupt Stall. Indicates the support for Wait For Interrupt (WFI) stalling: 
ex1 Support for WFI stalling. 


MemBarr, [23:20] 
Memory Barrier. Indicates the supported CP15 memory barrier operations. 


@x2 Supported CP15 memory barrier operations are: 
¢ Data Synchronization Barrier (DSB). 
¢ Instruction Synchronization Barrier (ISB). 
¢ Data Memory Barrier (DMB). 


UniTLB, [19:16] 


Unified TLB. Indicates the supported TLB maintenance operations, for a unified TLB 
implementation. 


@x6 Supported unified TLB maintenance operations are: 

¢ Invalidate all entries in the TLB. 

¢ Invalidate TLB entry by MVA. 

¢ Invalidate TLB entries by ASID match. 

¢ Invalidate instruction TLB and data TLB entries by MVA All ASID. This is a 
shared unified TLB operation. 

¢ Invalidate Hyp mode unified TLB entry by MVA. 

¢ Invalidate entire Non-secure EL1 and ELO unified TLB. 

¢ Invalidate entire Hyp mode unified TLB. 

¢* TLBIMVALIS, TLBIMVAALIS, TLBIMVALHIS, TLBIMVAL, TLBIMVAAL, and TLBIMVALH. 

¢ TLBIIPAS2IS, TLBIIPAS2LIS, TLBIIPAS2, and TLBIIPAS2L. 


HvdTLB, [15:12] 


Harvard TLB. Indicates the supported TLB maintenance operations, for a Harvard TLB 
implementation: 


exe Not supported. 
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LL1HvdRng, [11:8] 


LI Harvard cache Range. Indicates the supported L1 cache maintenance range operations, for a 
Harvard cache implementation: 


@xe Not supported. 


L1HvdBG, [7:4] 


L1 Harvard cache Background fetch. Indicates the supported L1 cache background prefetch 
operations, for a Harvard cache implementation: 


@xe Not supported. 


L1HvdFG, [3:0] 


L1 Harvard cache Foreground fetch. Indicates the supported L1 cache foreground prefetch 
operations, for a Harvard cache implementation: 


@xe Not supported. 


Configurations 


ID_MMFR2 ELI is architecturally mapped to AArch32 register ID_ MMFR2. See 
B1.70 ID_MMFR2, Memory Model Feature Register 2 on page B1-235. 


Must be interpreted with ID MMFRO_EL1, ID MMFRI ELI, ID MMFR3_ ELI, and 
ID_MMFR4 ELI. See: 

¢ B2.74 ID _MMFRO_ELI, AArch32 Memory Model Feature Register 0, EL] on page B2-409. 
¢ B2.75 ID _MMFRI_ ELI, AArch32 Memory Model Feature Register 1, EL1 on page B2-411. 
¢ B2.77 ID _MMFR3_ELI1, AArch32 Memory Model Feature Register 3, EL] on page B2-415. 
¢ B2.78 ID _MMFR4_ ELI, AArch32 Memory Model Feature Register 4, ELI] on page B2-417. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2.77 ID _MMFR3_EL1, AArch32 Memory Model Feature Register 3, EL1 
The ID MMFR3_ELI provides information about the memory model and memory management support 
in AArch32. 
Bit field descriptions 
ID_MMFR3 ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 
Figure B2-63 ID_MMFR3_EL1 bit assignments 
Supersec, [31:28] 
Supersections. Indicates support for supersections: 
exe Supersections supported. 
CMem$Sz, [27:24] 
Cached memory size. Indicates the size of physical memory supported by the core caches: 
@x2 1TByte or more, corresponding to a 40-bit or larger physical address range. 
CohWalk, [23:20] 
Coherent walk. Indicates whether translation table updates require a clean to the point of 
unification: 
ex1 Updates to the translation tables do not require a clean to the point of unification to 
ensure visibility by subsequent translation table walks. 
PAN, [19:16] 
Privileged Access Never. 
@x2 
PAN supported and new ATS1CPRP and ATS1CPWP instructions supported. 
MaintBest, [15:12] 
Maintenance broadcast. Indicates whether cache, TLB, and branch predictor operations are 
broadcast: 
@x2 Cache, TLB, and branch predictor operations affect structures according to 
shareability and defined behavior of instructions. 
BPMaint, [11:8] 
Branch predictor maintenance. Indicates the supported branch predictor maintenance operations. 
@x2 Supported branch predictor maintenance operations are: 
¢ Invalidate all branch predictors. 
¢ Invalidate branch predictors by MVA. 
CMaintSwW, [7:4] 
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B2 AArch64 system registers 
B2.77 ID_LMMFR3_EL1, AArch32 Memory Model Feature Register 3, EL1 


Cache maintenance by set/way. Indicates the supported cache maintenance operations by set/ 
way. 
ex1 Supported hierarchical cache maintenance operations by set/way are: 

¢ Invalidate data cache by set/way. 


¢ Clean data cache by set/way. 
¢ Clean and invalidate data cache by set/way. 


CMaintVA, [3:0] 


Cache maintenance by Virtual Address (VA). Indicates the supported cache maintenance 
operations by VA. 


@x1 Supported hierarchical cache maintenance operations by VA are: 
¢ Invalidate data cache by VA. 
* Clean data cache by VA. 
¢ Clean and invalidate data cache by VA. 
¢ Invalidate instruction cache by VA. 
¢ Invalidate all instruction cache entries. 


Configurations 


ID_MMFR3_EL1 is architecturally mapped to AArch32 register ID_ MMFR3. See 
B1.71 ID_MMFR3, Memory Model Feature Register 3 on page B1-237. 


Must be interpreted with ID MMFRO_EL1, ID MMFRI ELI, ID MMFR2 ELI, and 
ID_MMFR4 ELI. See: 

¢ B2.74ID_MMFRO_ELI, AArch32 Memory Model Feature Register 0, ELI on page B2-409. 
¢ B2.75 ID _MMFRI_ ELI, AArch32 Memory Model Feature Register 1, ELI on page B2-411. 
¢ B2.76 ID _MMFR2_ ELI, AArch32 Memory Model Feature Register 2, ELI on page B2-413. 
¢ B2.78 ID _MMFR4_ ELI, AArch32 Memory Model Feature Register 4, ELI on page B2-417. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.78 ID_LMMFR4_EL1, AArch32 Memory Model Feature Register 4, EL1 


B2.78 ID _MMFR4_EL1, AArch32 Memory Model Feature Register 4, EL1 


The ID MMFR4 ELI provides information about the memory model and memory management support 
in AArch32. 

Bit field descriptions 

ID_MMFR4 EL] is a 32-bit register, and is part of the Identification registers functional group. 

This register is Read Only. 


31 24 23 20 19 1615 12 11 8 7 4 3 0 


Figure B2-64 ID_MMFR4_EL1 bit assignments 
RAZ, [31:24] 
Read-As-Zero. 
LSM, [23:20] 
Load/Store Multiple. Indicates whether adjacent loads or stores can be combined. The value is: 


exe LSMAOE and nTLSMD bit not supported. 
HD, [19:16] 


Presence of Hierarchical Disables. Enables an operating system or hypervisor to hand over up to 
4 bits of the last level page table descriptor (bits[62:59] of the page table entry) for use by 
hardware for IMPLEMENTATION DEFINED usage. The value is: 


@x2 Hierarchical Permission Disables and Hardware allocation of bits[62:59] supported. 


CNP, [15:12] 
Common Not Private. Indicates support for selective sharing of TLB entries across multiple 
PEs. The value is: 


@x1 CnP bit supported. 


XNX, [11:8] 
Execute Never. Indicates whether the stage 2 translation tables allows the stage 2 control of 
whether memory is executable at EL1 independent of whether memory is executable at ELO. 
The value is: 


@x1 ELO/EL1 execute control distinction at stage2 bit supported. 
AC2, [7:4] 


Indicates the extension of the ACTLR and HACTLR registers using ACTLR2 and HACTLR2. 
The value is: 


@x1 ACTLR2 and HACTLR2 are implemented. 
SpecSEI, [3:0] 


Describes whether the core can generate SError interrupt exceptions from speculative reads of 
memory, including speculative instruction fetches. The value is: 





exe The core never generates an SError interrupt due to an external abort on a speculative 
read. 
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B2 AArch64 system registers 
B2.78 ID_LMMFR4_EL1, AArch32 Memory Model Feature Register 4, EL1 


Configurations 


ID_MMFR4 ELI is architecturally mapped to AArch64 register ID_ MMFR4. See 
B1.72 ID_MMFR4, Memory Model Feature Register 4 on page B1-239. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Must be interpreted with ID MMFRO_EL1, ID MMFRI ELI, ID MMFR2 ELI, and 
ID_MMFR3 ELI. See: 

¢ B2.74ID_MMFRO_ELI, AArch32 Memory Model Feature Register 0, ELI on page B2-409. 
© B2.75 ID_MMFRI_ ELI, AArch32 Memory Model Feature Register 1, ELI on page B2-411. 
¢ B2.76 ID _MMFR2_ ELI, AArch32 Memory Model Feature Register 2, ELI on page B2-413. 
¢ B2.77 ID _MMFR3_ELI1, AArch32 Memory Model Feature Register 3, ELI on page B2-415. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.79 ID_PFRO_EL1, AArch32 Processor Feature Register 0, EL1 


B2.79 ID _PFRO_EL1, AArch32 Processor Feature Register 0, EL1 


The ID_PFRO_ ELI provides top-level information about the instruction sets supported by the core in 
AArch32. 


Bit field descriptions 
ID_PFRO_ ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 28 27 20 19 16.15 12.11 8 7 4 3 0 
RAS —hl CSV2 State3 State2 State1 Stated 


RESO 


Figure B2-65 ID_PFRO_EL1 bit assignments 
RAS, [31:28] 
RAS extension version. The value is: 


@x1 Version | of the RAS extension is present. 


RESO, [27:20] 
RESO Reserved. 
CSV2, [19:16] 


@xe This device does not disclose whether branch targets trained in one context can affect 
speculative execution in a different context. 


State3, [15:12] 
Indicates support for Thumb Execution Environment (T32EE) instruction set. This value is: 
exe Core does not support the T32EE instruction set. 
State2, [11:8] 
Indicates support for Jazelle. This value is: 
ex1 Core supports trivial implementation of Jazelle. 
Statel, [7:4] 
Indicates support for T32 instruction set. This value is: 


@x3 Core supports T32 encoding after the introduction of Thumb-2 technology, and for all 
16-bit and 32-bit T32 basic instructions. 


State0, [3:0] 
Indicates support for A32 instruction set. This value is: 
ex1 A32 instruction set implemented. 
Configurations 


ID_PFRO_EL1 is architecturally mapped to AArch32 register ID_PFRO. See B/.73 JD_PFRO, 
Processor Feature Register 0 on page B1-241. 
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B2.79 ID_PFRO_EL1, AArch32 Processor Feature Register 0, EL1 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.80 ID_PFR1_EL1, AArch32 Processor Feature Register 1, EL1 





B2.80 ID_PFR1_EL1, AArch32 Processor Feature Register 1, EL1 
The ID_PFR1_ ELI provides information about the programmers model and architecture extensions 
supported by the core. 
Bit field descriptions 
ID_PFR1_ ELI is a 32-bit register, and must be interpreted with ID_PFRO. It is part of the Identification 
registers functional group. 
This register is Read Only. 
31 28 27 20 19 16.15 12.11 8 7 4 3 0 
poco] ——___fewnmer] [ents] Seay | rons 
Virtualization— 
RESO 
Figure B2-66 ID_PFR1_EL1 bit assignments 
GIC CPU, [31:28] 
GIC CPU support: 
@x@ GIC CPU interface is disabled, GICCDISABLE is HIGH. 
ex1 GIC CPU interface is implemented and enabled, GICCDISABLE is LOW. 
RESO, [27:20] 
RESO Reserved. 
GenTimer, [19:16] 
Generic Timer support: 
@x1 Generic Timer is implemented. 
Virtualization, [15:12] 
Indicates support for Virtualization: 
ex1 The following Virtualization is implemented: 
¢ The SCR.SIF bit. 
¢ The modifications to the SCR.AW and SCR.FW bits described in the Virtualization 
Extensions. 
¢ The MSR (Banked register) and MRS (Banked register) instructions. 
¢ The ERET instruction. 
¢ EL2, Hyp mode, the HVC instruction implemented. 
MProgMod, [11:8] 
M profile programmers model support: 
@xe Not supported. 
Security, [7:4] 
Security support: 
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B2 AArch64 system registers 
B2.80 ID_PFR1_EL1, AArch32 Processor Feature Register 1, EL1 


ex1 The following Security items are implemented: 


ProgMod, [3:0] 


The VBAR register. 

The TTBCR.PDO and TTBCR.PD1 bits. 

The ability to access Secure or Non-secure physical memory is supported. 
EL3, Monitor mode, the SMC instruction implemented. 


Indicates support for the standard programmers model for Armv4 and later. 


Model must support User, FIQ, IRQ, Supervisor, Abort, Undefined, and System modes: 


@x1 Supported. 


Configurations 


ID_PFR1_ ELI is architecturally mapped to AArch32 register ID_PFR1. See B/.74 JD_PFRI, 
Processor Feature Register 1 on page B1-243. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.81 ID_PFR2_EL1, AArch32 Processor Feature Register 2, EL1 


B2.81 ID _PFR2_EL1, AArch32 Processor Feature Register 2, EL1 


The ID_PFR2_ EL] provides information about the programmers model and architecture extensions 
supported by the core. 


Bit field descriptions 
ID_PFR2_ ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 7 4 3 0 


RESO 


Figure B2-67 ID_PFR2_EL1 bit assignments 
RESO, [31:8] 


RESO Reserved. 


SSBS, [7:4] 

1 AArch32 provides the PSTATE.SSBS mechanism to mark regions that are Speculative 

Store Bypassing Safe (SSBS). 
CSV3, [3:0] 

1 Data loaded under speculation with a permission or domain fault cannot be used to 
form an address or generate condition codes to be used by instructions newer than the 
load in the speculative sequence. This is the reset value. 

Configurations 


There are no configuration notes. 
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B2 AArch64 system registers 
B2.82 IFSR32_EL2, Instruction Fault Status Register, EL2 


B2.82 IFSR32_EL2, Instruction Fault Status Register, EL2 


The IFSR32_EL2 allows access to the AArch32 IFSR register from AArch64 state only. Its value has no 
effect on execution in AArch64 state. 


Bit field descriptions 


IFSR32_EL2 is a 32-bit register, and is part of the Exception and fault handling registers functional 
group. 


There are two formats for this register. The current translation table format determines which format of 
the register is used. 


¢ B2.82.1 IFSR32_EL2 with Short-descriptor translation table format on page B2-424. 
¢ B2.82.2 IFSR32_EL2 with Long-descriptor translation table format on page B2-424. 


Configurations 


IFSR32_EL2 is architecturally mapped to AArch32 register IFSR(NS). See B/.75 JF'SR, 
Instruction Fault Status Register on page B1-245. 


RW fields in this register reset to UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 


¢ B2.82.1 IFSR32_EL2 with Short-descriptor translation table format on page B2-424. 
¢ B2.82.2 IFSR32_EL2 with Long-descriptor translation table format on page B2-424. 


B2.82.1 IFSR32_EL2 with Short-descriptor translation table format 
IFSR32_EL2 has a specific format when using the Short-descriptor translation table format. 


The following figure shows the IFSR32_EL2 bit assignments when using the Short-descriptor translation 
table format. 


When TTBCR.EAE== 


31 171615 131211109 8 


ees nn ee ed 


Fnv— ExT— L_LPAE 
FS|4] 
RESO 


Figure B2-68 IFSR32_EL2 bit assignments for Short-descriptor translation table format 
EXT, [12] 
External abort type. 


Read as zero. 


For aborts other than external aborts, this bit always returns 0. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


B2.82.2  IFSR32_EL2 with Long-descriptor translation table format 


IFSR32_EL2 has a specific format when using the Long-descriptor translation table format. 
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B2 AArch64 system registers 
B2.82 IFSR32_EL2, Instruction Fault Status Register, EL2 


The following figure shows the IFSR32_EL2 bit assignments when using the Long-descriptor translation 
table format. 


When TTBCR.EAE==1: 


31 171615 131211109 8 
Fnv — L_exT L_LPAE 
RESO 


Figure B2-69 IFSR32_EL2 bit assignments for Long-descriptor translation table format 
EXT, [12] 
External abort type. 


Read as zero. 


For aborts other than external aborts, this bit always returns 0. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2.83 LORC_EL1, LORegion Control Register, EL1 


B2.83 LORC_EL1, LORegion Control Register, EL1 
The LORC_ELI register enables and disables LORegions, and selects the current LORegion descriptor. 


Bit field descriptions 


LORC_EL] is a 64-bit register and is part of the Virtual memory control registers functional group. 


63 43210 
os | | | 
EN—! 


RESO 


Figure B2-70 LORC_EL1 bit assignments 


[63:4] 
Reserved, RESO. 


DS, [3:2] 
Descriptor Select. Number that selects the current LORegion descriptor accessed by the 
LORSA_EL1, LOREA_EL1, and LORN_ELI registers. 


[1] 


Reserved, RESO. 
EN, [0] 
Enable. The possible values are: 
@ Disabled. This is the reset value. 
1 Enabled. 
Configurations 


The LORC_ ELI register is only applicable to the AArch64 state and is not accessible at any 
Exception level in AArch32. 


RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2.84 LOREA_EL1, LORegion End Address Register, EL1 


The LOREA ELI register holds the physical address of the end of the LORegion described in the 
current LORegion descriptor selected by LORC_EL1.DS. 


Bit field descriptions 


LOREA EL] is a 64-bit register and is part of the Virtual memory control registers functional group. 


63 48 47 16 15 0 





RESO 
Figure B2-71 LOREA_EL1 bit assignments 
[63:48] 
Reserved, RESO. 
EA, [47:16] 
End physical address bits. 
[15:0] 
Reserved, RESO. 
Configurations 
The LOREA ELI register is only applicable to the AArch64 state and is not accessible at any 
exception level in AArch32. 
If no LORegion descriptors are supported by the core, then this register is RESO. 
If LORC_EL1.DS points to a LORegion that is not supported by the core, then this register is 
RESO. 
RW fields in this register reset to architecturally UNKNOWN 
Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2.85 LORID_EL1, Limited Order Region Identification Register, EL1 


B2.85 LORID_EL1, Limited Order Region Identification Register, EL1 


The LORID_EL1 indicates the number of LORegions and LORegion descriptors supported by the 
Cortex-A55 core. 


Bit field descriptions 
LORID_ EL] is a 64-bit register, and is part of the Virtual memory control registers functional group. 


This register is Read Only. 


63 24 23 1615 8 7 0 
ee 
RESO 


Figure B2-72 LORID_EL1 bit assignments 
RESO, [63:24] 
Reserved, RESO. 
LD, [23:16] 
Indicates the number of LOR Descriptors supported by the core. The value is: 
@x4 Four LOR Descriptors supported. 
RESO, [15:8] 
Reserved, RESO. 
LR, [7:0] 
Indicates the number of LORegions supported by the core. The value is: 


@x4 Four LORegions supported. 


Configurations 
The LORID ELI is only applicable to the AArch64 state and is not accessible at any exception 
level in AArch32. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2.86 LORN_EL1, LORegion Number Register, EL1 


B2.86 LORN_EL1, LORegion Number Register, EL1 


The LORN _ ELI register holds the number of the LORegion described in the current LORegion 
descriptor selected by LORC_EL1.DS. 


Bit field descriptions 


LORN_ ELI is a 64-bit register and is part of the Virtual memory control registers functional group. 


63 210 


RESO 


Figure B2-73 LORN_EL1 bit assignments 


[63:2] 
Reserved, RESO. 


Num, [1:0] 
Indicates the LORegion number. 


Configurations 


The LORN _ ELI register is only applicable to the AArch64 state and is not accessible at any 
Exception level in AArch32. 


RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.87 LORSA_EL1, LORegion Start Address Register, EL1 


B2.87 LORSA_EL1, LORegion Start Address Register, EL1 


The LORSA_ELI register indicates whether the current LORegion descriptor selected by 
LORC_EL1.DS is is enabled, and holds the physical address of the start of the LORegion. 


Bit field descriptions 


LORSA_EL1 is a 64-bit register and is part of the Virtual memory control registers functional group. 


63 48 47 16 15 10 
Valid — 
RESO 


Figure B2-74 LORSA_EL1 bit assignments 


RESO, [63:48] 
Reserved, RESO. 


SA, [47:16] 
Start physical address bits. 


RESO, [15:1] 
Reserved, RESO. 


Valid, [0] 
Valid. Indicates whether the LORegion Descriptor is enabled. The possible values are: 
@ Not valid. This is the reset value. 
1 Valid. 

Configurations 


The LORSA_ ELI register is only applicable to the AArch64 state and is not accessible at any 
exception level in AArch32. 


If no LORegion descriptors are supported by the core, then this register is RESo. 


If LORC_EL1.DS points to a LORegion that is not supported by the core, then this register is 
RESO. 


RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.88 MDCR_EL3, Monitor Debug Configuration Register, EL3 


B2.88 MDCR_EL3, Monitor Debug Configuration Register, EL3 
The MDCR_EL3 provides configuration options for Security to self-hosted debug. 


Bit field descriptions 
MDCR_EL3 is a 32-bit register, and is part of: 


¢ The Debug registers functional group. 
¢ The Security registers functional group. 


31 22 212019181716151413 11109 8 7 65 0 


EPMAD el L spp32 he TDA LTPM 
EDAD SDD TDOSA 
SPME 
RESO 


Figure B2-75 MDCR_EL3 bit assignments 
EPMAD, [21] 


External debugger access to Performance Monitors registers disabled. This disables access to 
these registers by an external debugger. The possible values are: 


() Access to Performance Monitors registers from external debugger is permitted. 


1 Access to Performance Monitors registers from external debugger is disabled, unless 
overridden by authentication interface. 


EDAD, [20] 


External debugger access to breakpoint and watchpoint registers disabled. This disables access 
to these registers by an external debugger. The possible values are: 


7) Access to breakpoint and watchpoint registers from external debugger is permitted. 


1 Access to breakpoint and watchpoint registers from external debugger is disabled, 
unless overridden by authentication interface. 


SPME, [17] 


Secure performance monitors enable. This enables event counting exceptions from Secure state. 
The possible values are: 


7) Event counting prohibited in Secure state. 
1 Event counting allowed in Secure state. 
SPD32, [15:14] 


AArch32 secure privileged debug. Enables or disables debug exceptions from Secure state if 
Secure EL] is using AArch32, other than software breakpoint instructions. The possible values 


are: 

ee Legacy mode. Debug exceptions from Secure EL] are enabled only if 
AArch32SelfHostedSecurePrivilegedInvasiveDebugEnabled(). 

@1 Reserved. 

10 Secure privileged debug disabled. Debug exceptions from Secure EL] are disabled. 

11 Secure privileged debug enabled. Debug exceptions from Secure EL] are enabled. 


The reset value is UNKNOWN. 
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B2 AArch64 system registers 
B2.88 MDCR_EL3, Monitor Debug Configuration Register, EL3 


TDOSA, [10] 


Trap accesses to the OS debug system registers, OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, and 
DBGPRCR_ELI OS. 


2) Accesses are not trapped. 


1 Accesses to the OS debug system registers are trapped to EL3. 


The reset value is UNKNOWN. 


TDA, [9] 
Trap accesses to the remaining sets of debug registers to EL3. 
2) Accesses are not trapped. 
1 Accesses to the remaining debug system registers are trapped to EL3. 


The reset value is UNKNOWN. 


Configurations 
There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.89 MIDR_EL1, Main ID Register, EL1 


MIDR_EL1, Main ID Register, EL1 


The MIDR_EL1 provides identification information for the core, including an implementer code for the 
device and a device ID number. 
Bit field descriptions 
MIDR_ ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 
31 24 23 20 19 16 15 4 3 0 


Figure B2-76 MIDR_EL1 bit assignments 
Implementer, [31:24] 
Indicates the implementer code. This value is: 


@x41 ASCII character 'A' - implementer is Arm Limited. 


Variant, [23:20] 


Indicates the variant number of the core. This is the major revision number x in the rx part of the 
rxpy description of the product revision status. This value is: 


@x2 12p0. 


Architecture, [19:16] 
Indicates the architecture code. This value is: 


@xF Defined by CPUID scheme. 


PartNum, [15:4] 
Indicates the primary part number. This value is: 


@xD@5 Cortex-A55 core. 


Revision, [3:0] 


Indicates the minor revision number of the core. This is the minor revision number y in the py 
part of the rxpy description of the product revision status. This value is: 


@x® 12p0. 


Configurations 
The MIDR_EL1 is: 
¢ Architecturally mapped to the AArch32 MIDR register. See B/.76 MIDR, Main ID Register 
on page B1-247. 
¢ Architecturally mapped to external MIDR_ELI register. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B2-433 


reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.90 MPIDR_EL1, Multiprocessor Affinity Register, EL1 


MPIDR_EL1, Multiprocessor Affinity Register, EL1 


The MPIDR_ELI provides an additional core identification mechanism for scheduling purposes in a 
cluster. 


Bit field descriptions 
MPIDR _ELI is a 64-bit register, and is part of the Other system control registers functional group. 


This register is Read Only. 


63 4039, 3231 30 29,25 24 23 i 16 15 8 7 0 





Aff3 U| UNK Aff2 Aff1 AffO 


$f 55 55 $f 



































RES1 
RESO 


Figure B2-77 MPIDR_EL1 bit assignments 
RESO, [63:40] 
RESO Reserved. 
Aff3, [39:32] 
Affinity level 3. Highest level affinity field. 


CLUSTERID 
Indicates the value read in the CLUSTERIDAFF3 configuration signal. 


RES1, [31] 
RES! Reserved. 
U, [30] 
Indicates a single core system, as distinct from core 0 in a cluster. This value is: 


7) Core is part of a multiprocessor system. This is the value for implementations with 
more than one core, and for implementations with an ACE or CHI master interface. 


[29:25] 
UNK Reserved. 
MT, [24] 


Indicates whether the lowest level of affinity consists of logical cores that are implemented 
using a multithreading type approach. This value is: 


1 Performance of PEs at the lowest affinity level is very interdependent. 
Affinity0 represents threads. Cortex-A55 is not multithreaded, but may be in a system 
with other cores that are multithreaded. 
Aff2, [23:16] 
Affinity level 2. Second highest level affinity field. 
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B2 AArch64 system registers 
B2.90 MPIDR_EL1, Multiprocessor Affinity Register, EL1 


CLUSTERID 
Indicates the value read in the CLUSTERIDAFF?2 configuration signal. 


Aff1, [15:12] 
Part of Affinity level 1. Third highest level affinity field. 


RAZ Read-As-Zero. 


Affl, [11:8] 
Part of Affinity level 1. Third highest level affinity field. 
CPUID Identification number for each CPU in the Cortex-A55 cluster: 


exe MP1: CPUID: 0. 
to 


@x7 MP8: CPUID: 7. 


Aff0, [7:0] 
Affinity level 0. The level identifies individual threads within a multithreaded core. The Cortex- 
AS55 core is single-threaded, so this field has the value @xee. 


Configurations 
MPIDR_EL1[31:0] is: 
« Architecturally mapped to AArch32 register MPIDR. See B/.77 MPIDR, Multiprocessor 
Affinity Register on page B1-248. 
¢ Mapped to external register EDDEVAFFO. 


MPIDR_EL1[63:32] is mapped to external register EDDEVAFF1. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.91 PAR_EL1, Physical Address Register, EL1 


B2.91 PAR_EL1, Physical Address Register, EL1 


The PAR_ELI returns the output address from an address translation instruction that executed 
successfully, or fault information if the instruction did not execute successfully. 


Bit field descriptions, PAR_EL1.F is 0 
The following figure shows the PAR bit assignments when PAR.F is 0. 






63 56 55 40.39 1211109 8 7 6 10 
ATTR | | PA a 


LPAE — 
IMP DEF 
NS 


Figure B2-78 PAR bit assignments, PAR_EL1.F is 0 


RESO 


IMP DEF, [10] 


IMPLEMENTATION DEFINED. Bit[10] is RESO. 


F, [0] 
Indicates whether the instruction performed a successful address translation. 
) Address translation completed successfully. 
1 Address translation aborted. 

Configurations 


There are no configuration notes. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


Bit field descriptions, PAR_EL1.F is 1 


See the Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.92 REVIDR_EL1, Revision ID Register, EL1 


B2.92 REVIDR_EL1, Revision ID Register, EL1 
The REVIDR_ ELI provides revision information, additional to MIDR_EL1, that identifies minor fixes 
(errata) which might be present in a specific implementation of the Cortex-A55 core. 
Bit field descriptions 
REVIDR_ ELI is a 32-bit register, and is part of the Identification registers functional group. 
This register is Read Only. 


31 0 


IMPLEMENTATION DEFINED 


Figure B2-79 REVIDR_EL1 bit assignments 


IMPLEMENTATION DEFINED, [31:0] 


IMPLEMENTATION DEFINED. 


Configurations 


REVIDR_ELI is architecturally mapped to AArch32 register REVIDR. See B/.79 REVIDR, 
Revision ID Register on page B1-255. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.93 RVBAR_EL3, Reset Vector Base Address Register, EL3 


B2.93 RVBAR_EL3, Reset Vector Base Address Register, EL3 


If EL3 is the highest Exception level implemented, RVBAR_EL3 contains the IMPLEMENTATION DEFINED 
address that execution starts from after reset when executing in AArch64 state. 


Bit field descriptions 
RVBAR EL3 is a 64-bit register, and is part of the Reset management registers functional group. 
This register is Read Only. 


63 40 39 0 


$5 
Reset Vector Base Address 


Figure B2-80 RVBAR_EL3 bit assignments 





RESO 


RESO, [63:40] 
Reserved, RESO. 
RVBA, [39:0] 


Reset Vector Base Address. The address that execution starts from after reset when executing in 
64-bit state. Bits[1:0] of this register are @b@@, as this address must be aligned, and bits [63:40] 
are @x@00000 because the address must be within the physical address size supported by the 
core. 


The Reset Vector Base Address is determined by the signal RVBARADDR«x. 
Configurations 
There is no configuration information. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.94 SCTLR_EL1, System Control Register, EL1 


SCTLR_EL1, System Control Register, EL1 


The SCTLR_ELI provides top level control of the system, including its memory system, at EL1 and 
ELO. 


Bit field descriptions 


SCTLR_ELI is a 32-bit register, and is part of the Other system control registers functional group. 
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Figure B2-81 SCTLR_EL1 bit assignments 
EE, [25] 


Exception endianness. The value of this bit controls the endianness for explicit data accesses at 
EL1. This value also indicates the endianness of the translation table data for translation table 
lookups. The possible values of this bit are: 


7) Little-endian. 

1 Big-endian. 

The reset value of this bit is determined by the CFGEND configuration signal. 
EOE, [24] 


Endianness of explicit data access at ELO. The possible values are: 


) Explicit data accesses at ELO are little-endian. This is reset value. 
1 Explicit data accesses at ELO are big-endian. 
SED, [8] 
SETEND instruction disable. The possible values are: 
) The SETEND instruction is enabled. This is the reset value. 
1 The SETEND instruction is UNDEFINED. 
Configurations 


SCTLR_ELI is architecturally mapped to AArch32 register SCTLR(NS) See B/.8/ SCTLR, 
System Control Register on page B1-257. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.95 SCTLR_EL2, System Control Register, EL2 


B2.95 SCTLR_EL2, System Control Register, EL2 


The SCTLR_EL2 provides top-level control of the system, including its memory system at EL2. 


Bit field descriptions 

SCTLR_EL2 is a 32-bit register, and is part of: 

¢ The Virtualization registers functional group. 

¢ The Other system control registers functional group. 





Figure B2-82 SCTLR_EL2 bit assignments 


Apart from bits [12], [2], and [0], this register resets to UNKNOWN values. 


Configurations 


SCTLR_EL2 is architecturally mapped to AArch32 register HSCTLR. See B/.56 HSCTLR, Hyp 
System Control Register on page B1-210. 


If EL2 is not implemented, this register is Reso from EL3. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.96 SCTLR_EL3, System Control Register, EL3 


B2.96 SCTLR_EL3, System Control Register, EL3 
The SCTLR_EL3 provides top level control of the system, including its memory system at EL3. 


Bit field descriptions 


SCTLR_EL3 is a 32-bit register, and is part of the Other system control registers functional group. 
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Figure B2-83 SCTLR_EL3 bit assignments 


EE, [25] 
Exception endianness. This bit controls the endianness for: 
¢ Explicit data accesses at EL3. 
¢ Stage 1 translation table walks at EL3. 


The possible values are: 


@ Little endian. This is the reset value. 
1 Big endian. 
Configurations 


Some or all RW fields of this register have defined reset values. These apply only if the PE 
resets into EL3 using AArch64. Otherwise, RW fields in this register reset to architecturally 
UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.97 TCR_EL1, Translation Control Register, EL1 


B2.97 TCR_EL1, Translation Control Register, EL1 


The TCR_EL1 determines which Translation Base registers define the base address register for a 
translation table walk required for stage | translation of a memory access from ELO or EL] and holds 
cacheability and shareability information. 


Bit field descriptions 
TCR_ELI is a 64-bit meee, and is pat of the Virtual memory control registers functional group. 
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Figure B2-84 TCR_EL1 bit assignments 





Note 
Bits[50:39], architecturally defined, are implemented in the core. 





HD, [40] 
Hardware management of dirty state in stage | translations from ELO and EL1. The possible 
values are: 
) Stage | hardware management of dirty state disabled. 
1 Stage | hardware management of dirty state enabled, only if the HA bit is also set to 1. 
HA, [39] 
Hardware Access flag update in stage 1 translations from ELO and EL1. The possible values are: 
) Stage | Access flag update disabled. 
1 Stage | Access flag update enabled. 
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B2 AArch64 system registers 
B2.97 TCR_EL1, Translation Control Register, EL1 


Configurations 
TCR_ELI is architecturally mapped to AArch32 register TTBCR(NS). 
RW fields in this register reset to UNKNOWN values. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.98 TCR_EL2, Translation Control Register, EL2 


B2.98 TCR_EL2, Translation Control Register, EL2 


The TCR_EL2 controls translation table walks required for stage | translation of a memory access from 
EL2 and holds cacheability and shareability information. 


Bit field descriptions 
TCR_EL2 is a 64-bit register, and is part of: 


¢ The Virtualization registers functional group. 
¢ The Virtual memory control registers functional group. 


The register has configurations of bit assignment dependent upon whether the core is running a 
hypervisor or running a host Host Operating System. This is controlled by the value of the E2H bit in 
register HCR_EL2: 


) Hpervisor configuration, see When HCR_EL2.E2H==0 on page B2-444. 


1 Host Operating System configuration: HCR_EL2.E2H==1 Address translation aborted, see 
When HCR_EL2.E2H==1 on page B2-446. 


Configurations 


TCR_EL2 is architecturally mapped to AArch32 register HTCR. See the Arm® Architecture 
Reference Manual Armvé8, for Armv8-A architecture profile. 


If EL2 is not implemented, this register is Reso from EL3. 


RW fields in this register reset to architecturally UNKNOWN values. 


When HCR_EL2.E2H== 
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Figure B2-85 TCR_EL2 bit assignments when HCR_EL2.E2H== 
HPD, [24] 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, 
and UXNTable, except NSTable, in the translation tables pointed to by TTBRO_EL2. The 
possible values are: 


e Hierarchical Permissions are enabled. 
1 Hierarchical Permissions are disabled. 
Note 





In this case bit[61] (APTable[0]) and bit[59] (PXNTable) of the next level descriptor 
attributes are required to be to be ignored by the PE, and are no longer reserved, 
allowing them to be used by software. 


HD, [22] 
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B2 AArch64 system registers 
B2.98 TCR_EL2, Translation Control Register, EL2 


Hardware management of dirty state in stage | translations from EL2. The possible values are: 


7) Stage | hardware management of dirty state disabled. 
1 Stage | hardware management of dirty state enabled, only if the HA bit is also set to 1. 


Implementation of this bit is OPTIONAL, and, if not implemented, this bit is RESo. 


HA, [21] 
Hardware Access flag update in stage | translations from EL2. The possible values are: 
7) Stage | Access flag update disabled. 
1 Stage | Access flag update enabled. 

PS, [18:16] 


Physical address size. The possible values are: 
@beee@ 32 bits, 4GB. 
@bee1 36 bits, 64GB. 
@be1e 40 bits, 1TB. 
Other values are reserved. 
TGO, [15:14] 
TTBRO_EL2 granule size. The possible values are: 


ebee )§=—«-: AK BB. 
@be1 =: O64 KKB. 
@b10 16KB. 


@b11 ~—&Resserved. 


All other values are not supported. 
SHO, [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO_EL2. 
The possible values are: 
@bee ~=Non-shareable. 
@b@1 ~—CReeserved. 


@b10 Outer shareable. 
@b11 ~— Inner shareable. 
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B2 AArch64 system registers 
B2.98 TCR_EL2, Translation Control Register, EL2 


When HCR_EL2.E2H==1 
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Figure B2-86 TCR_EL2 bit assignments when HCR_EL2.E2H== 


HD, [40] 


Hardware management of dirty state in stage | translations from ELO and EL1. The possible 
values are: 


) Stage | hardware management of dirty state disabled. 
1 Stage | hardware management of dirty state enabled, only if the HA bit is also set to 1. 


Implementation of this bit is OPTIONAL, and, if not implemented, this bit is RESo. 


HA, [39] 
Hardware Access flag update in stage | translations from ELO and EL1. The possible values are: 
) Stage | Access flag update disabled. 
1 Stage | Access flag update enabled. 


Implementation of this bit is OPTIONAL, and, if not implemented, this bit is REso. 
TGO, [15:14] 


TTBRO_ EL] granule size. The possible values are: 


ebee)=—«- AK BB. 
@b10 16KB. 
@be1 =: 64 KB. 


@b11 ~—&Resserved. 


All other values are not supported. 


SHO, [13:12] 


Shareability attribute for memory associated with translation table walks using TTBRO_EL1. 
The possible values are: 
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@bee 
@be1 
@b10 
@b11 


B2 AArch64 system registers 


B2.98 TCR_EL2, Translation Control Register, EL2 


Non-shareable. 
Reserved. 
Outer shareable. 


Inner shareable. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 


Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.99 TCR_EL3, Translation Control Register, EL3 
B2.99 TCR_EL3, Translation Control Register, EL3 


The TCR_EL3 controls translation table walks required for stage | translation of memory accesses from 
EL3 and holds cacheability and shareability information for the accesses. 


Bit field descriptions 


TCR_EL3 is a 32-bit register, and is part of the Virtual memory control registers functional group. 
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Figure B2-87 TCR_EL3 bit assignments 
HPD, [24] 
Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, 


and UXNTable, except NSTable, in the translation tables pointed to by TTBRO_EL3. The 
possible values are: 


(7) Hierarchical Permissions are enabled. 
1 Hierarchical Permissions are disabled. 
Note 





In this case bit[61] (APTable[0]) and bit[59] (PXNTable) of the next level descriptor 
attributes are required to be to be ignored by the PE, and are no longer reserved, 
allowing them to be used by software. 





HD, [22] 
Hardware management of dirty state in stage | translations from EL3. The possible values are: 


) Stage 1 hardware management of dirty state disabled. 
1 Stage | hardware management of dirty state enabled, only if the HA bit is also set to 1. 


Implementation of this bit is OPTIONAL, and, if not implemented, this bit is RESo. 
HA, [21] 


Hardware Access flag update in stage | translations from EL3. The possible values are: 


) Stage | Access flag update disabled. 
1 Stage | Access flag update enabled. 
PS, [18:16] 


Physical address size. The possible values are: 


@beee@ 32 bits, 4GB. 
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@be01 


B2 AArch64 system registers 
B2.99 TCR_EL3, Translation Control Register, EL3 


36 bits, 64GB. 


@be1e@ 40 bits, 1TB. 


Other values are reserved. 


TGO, [15:14] 


TTBRO_EL3 granule size. The possible values are: 


@bee 
@b10 
@be1 
@b11 


A4KB. 
16KB. 
64KB. 
Reserved. 


All other values are not supported. 


SHO, [13:12] 


Shareability attribute for memory associated with translation table walks using TTBRO_EL3. 


The possible values are: 


@bee 
@be1 
@b10 
@b11 


Non-shareable. 
Reserved. 
Outer shareable. 


Inner shareable. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.100 TTBRO_EL1, Translation Table Base Register 0, EL1 


B2.100 TTBRO_EL1, Translation Table Base Register 0, EL1 


The TTBRO_EL1 holds the base address of translation table 0, and information about the memory it 
occupies. This is one of the translation tables for the stage | translation of memory accesses from modes 
other than Hyp mode. 
This register is used when HCR_EL2.E2H is 0. 

Note 
When HCR_EL2.E2H is 1, TTBRO_EL2 is used. 








Bit field descriptions 


TTBRO_ELI is a 64-bit register, and is part of the Virtual memory control registers functional group. 
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Figure B2-88 TTBRO_EL1 bit assignments 
ASID, [63:48] 


An ASID for the translation table base address. The TCR_EL1.A1 field selects either 
TTBRO_EL1.ASID or TTBR1_EL1.ASID. 


BADDR, [47:2] 
Translation table base address. 
RESO, [1] 


RESO Reserved. 


CnP, [0] 
Common not Private. Supports selective sharing of TLB entries across multiple cores. The value 
is: 
) CnP is not supported. 
1 CnP is supported. 
Configurations 


TTBRO_EL] is architecturally mapped to AArch32 register TTBRO. See B/.85 TTBRO, 
Translation Table Base Register 0 on page B1-269. 


RW fields in this register reset to architecturally UNKNOWN values. 
Any of the fields in this register are permitted to be cached in a TLB. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.101 TTBRO_EL2, Translation Table Base Register 0, EL2 


B2.101 TTBRO_EL2, Translation Table Base Register 0, EL2 


The TTBRO_EL2 holds the base address of the translation table for the stage 1 translation of memory 
accesses from EL2. 


Bit field descriptions 


TTBRO_EL2 is a 64-bit register, and is part of the Virtual memory control registers functional group. 
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Figure B2-89 TTBRO_EL2 bit assignments 
RESO, [63:48] 


RESO Reserved. 


BADDR, [47:1] 
Translation table base address, bits[47:x]. Bits [x-1:1] are REso. 


x is based on the value of TCR_EL2.TOSZ, the stage of translation, and the memory translation 
granule size. 


For instructions on how to calculate it, see the Arm® Architecture Reference Manual Arm®v8, for 
Arm®v8-A architecture profile. 


The value of x determines the required alignment of the translation table, that must be aligned to 
2* bytes. 


If bits [x-1:1] are not all zero, this is a misaligned translation table base address. Its effects are 
CONSTRAINED UNPREDICTABLE, Where bits [x-1:1] are treated as if all the bits are zero. The value 
read back from those bits is the value written. 


CnP, [0] 
Common not Private. The possible values are: 


) CnP is not supported. 
1 CnP is supported. 


Configurations 


TTBRO_EL2 is architecturally mapped to AArch32 register HTTBR, Hyp Translation Table 
Base Register. 


When the Virtualization Host Extension is activated, TTBRO EL2 has the same bit assignments 
as TTBRO ELI. 


Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.102 TTBRO_EL3, Translation Table Base Register 0, EL3 


B2.102 TTBRO_EL3, Translation Table Base Register 0, EL3 


The TTBRO_EL3 holds the base address of the translation table for the stage 1 translation of memory 
accesses from EL3. 


Bit field descriptions 


TTBRO_EL3 is a 64-bit register, and is part of the Virtual memory control registers functional group. 
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Figure B2-90 TTBRO_EL3 bit assignments 
RESO, [63:48] 


RESO Reserved. 


BADDR, [47:2] 
Translation table base address. 


RESO, [1] 
RESO Reserved. 
CnP, [0] 
Common not Private. The possible values are: 
) CnP is not supported. 
1 CnP is supported. 
Configurations 


TTBRO_EL3 is mapped to AArch32 register TTBRO (S). See B/.85 TTBRO, Translation Table 
Base Register 0 on page B1-269. 


RW fields in this register reset to architecturally UNKNOWN values. 
Any of the fields in this register are permitted to be cached in a TLB. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.103 TTBR1_EL1, Translation Table Base Register 1, EL1 


B2.103 TTBR1_EL1, Translation Table Base Register 1, EL1 


The TTBR1_ ELI holds the base address of translation table 1, and information about the memory it 
occupies. This is one of the translation tables for the stage | translation of memory accesses at ELO and 
ELI. 
This register is used when HCR_EL2.E2H is 0. 

Note 
When HCR_EL2.E2H is 1, TTBR1_EL2 is used. 








Bit field descriptions 


TTBRI1_ELI is a 64-bit register, and is part of the Virtual memory control registers functional group. 


63 . 48 47 210 


CnP — 























RESO 


Figure B2-91 TTBR1_EL1 bit assignments 
ASID, [63:48] 


An ASID for the translation table base address. The TCR_EL1.A1 field selects either 
TTBRO_EL1.ASID or TTBR1_EL1.ASID. 


BADDR, [47:2] 
Translation table base address. 
RESO, [1] 


RESO Reserved. 


CnP, [0] 
Common not Private. Supports selective sharing of TLB entries across multiple cores. The 
possible values are: 


) CnP is not supported. 
1 CnP is supported. 
Configurations 


TTBRI1_ EL] is architecturally mapped to AArch32 register TTBR1 (NS). See B/.86 TTBR1, 
Translation Table Base Register 1 on page B1-271. 


RW fields in this register reset to architecturally UNKNOWN values. 
Any of the fields in this register are permitted to be cached in a TLB. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B2-453 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.104 TTBR1_EL2, Translation Table Base Register 1, EL2 


B2.104 TTBR1_EL2, Translation Table Base Register 1, EL2 
TTBRI1_EL2 has the same format and contents as TTBR1_ ELI. 
See B2.103 TTBR1_ ELI, Translation Table Base Register 1, EL] on page B2-453. 
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B2 AArch64 system registers 
B2.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 


B2.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 


The VDISR_EL2 records that a virtual SError interrupt has been consumed by an ESB instruction 
executed at Non-secure EL1. 
Bit field descriptions 


VDISR_EL2 is a 64-bit register, and is part of the Reliability, Availability, Serviceability (RAS) registers 
functional group. 


There are three formats for this register. The current translation table format determines which format of 
the register is used. 


¢ When written at EL1 using short-descriptor format. See B2./05.2 VDISR_EL2 with short-descriptor 
translation table format on page B2-456. 

¢ When written at EL1 using long-descriptor format. See B2./05.1 VDISR_EL2 with long-descriptor 
translation table format on page B2-455. 

¢« When written at EL2. See B2.105.3 VDISR_EL2 at ELI using AArch64 on page B2-457. 


Configurations 
VDISR_EL2 is reso at EL3 if EL2 is not implemented. 
Present only if all the following are present and is UNDEFINED otherwise. 


If the implementation supports AArch32 at EL2, VDISR_EL2 is architecturally mapped to 
VDISR. See B/.88 VDISR, Virtual Deferred Interrupt Status Register on page B1-274. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


This section contains the following subsections: 


¢ B2.105.1 VDISR_EL2 with long-descriptor translation table format on page B2-455. 
¢ B2.105.2 VDISR_EL2 with short-descriptor translation table format on page B2-456. 
¢ B2.105.3 VDISR_EL2 at ELI using AArch64 on page B2-457. 


B2.105.1 VDISR_EL2 with long-descriptor translation table format 


VDISR_EL2 has a specific format when using the Long-descriptor translation table format. 


Bit field descriptions 


The following figure shows the VDISR_EL2 bit assignments when EL] is using the AArch32 Long- 
descriptor format. 


63 32 31 30 16 15 14 13 10 9 8 6 5 0 
CF 


RESO 





Figure B2-92 VDISR_EL2 bit assignments for the Long-descriptor format 
RESO, [63:32] 
RESO Reserved. 
A, [31] 
Set to 1 when ESB defers a virtual SError interrupt. 
RESO, [30:16] 
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B2 AArch64 system registers 
B2.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 


RESO Reserved. 
AET, [15:14] 

Contains the value from VDFSR.AET. 
RESO, [13:10] 

RESO Reserved. 
LPAE, [9] 

Format. The value is: 


1 Using the Long-descriptor translation table format. 
RESO, [8:6] 
RESO Reserved. 


STATUS, [5:0] 


Fault status code. Set to @b@10001 when ESB defers a virtual SError interrupt. The value of this 
field is: 


@be10001 Asynchronous SError interrupt. 


B2.105.2 VDISR_EL2 with short-descriptor translation table format 


VDISR_EL2 has a specific format when using the Short-descriptor translation table format. 


Bit field descriptions 


The following figure shows the VDISR_EL2 bit assignments when EL] is using the AArch32 Short- 
descriptor translation table format. 


63 32 31 30 16151413 11109 8 4 3 0 
A FS[3:0] 


RESO 





Figure B2-93 VDISR_EL2 bit assignments for Short-descriptor translation table format 

RESO, [63:32] 

RESO Reserved. 
A, [31] 

Set to 1 when ESB defers a virtual SError interrupt. 
RESO, [30:16] 

RESO Reserved. 
AET, [15:14] 


Asynchronous Error Type. Describes the state of the PE after taking an asynchronous Data 
Abort exception. The value is: 


@be1 Uncorrected error, Unrecoverable error (UEU). 


RESO, [13:11] 
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B2 AArch64 system registers 
B2.105 VDISR_EL2, Virtual Deferred Interrupt Status Register, EL2 


RESO Reserved. 
FS[4], [10] 


Bit 4 of Fault status code. Set to @b10110 when ESB defers a virtual SError interrupt. The value 
of this field is: 


@b10112 Asynchronous SError interrupt. 


LPAE, [9] 
Format. The value is: 


@be@ Using the Short-descriptor translation table format. 


RESO, [8:4] 
RESO Reserved. 
FS[3:0], [3:0] 


Bits [3:0] of Fault status code. Set to @b10110 when ESB defers a virtual SError interrupt. The 
value of this field is: 


@b10112 Asynchronous SError interrupt. 


B2.105.3 VDISR_EL2 at EL1 using AArch64 
VDISR_EL2 has a specific format when written at EL1. 
The following figure shows the VDISR_EL2 bit assignments when written at EL1 using AArch64: 


63 32:31 30 25 24:23 0 
. 
L_|pDs 
RESO 


Figure B2-94 VDISR_EL2 at EL1 using AArch64 

RESO, [63:32] 

RESO Reserved. 
A, [31] 

Set to 1 when ESB defers an asynchronous SError interrupt. 
RESO, [30:25] 

RESO Reserved. 
IDS, [24] 

Contains the value from VSESR_EL2.IDS. 
ISS, [23:0] 

Contains the value from VSESR_EL2, bits[23:0]. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B2-457 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.106 VMPIDR_EL2, Virtualization Multiprocessor ID Register, EL2 


B2.106 VMPIDR_EL2, Virtualization Multiprocessor ID Register, EL2 


The VMPIDR_EL2 provides the value of the Virtualization Multiprocessor ID. This is the value returned 
by Non-secure EL1 reads of MPIDR. 


Bit field descriptions 
VMPIDR_ EL2 is a 64-bit register, and is part of: 


¢ The Identification registers functional group. 
¢ The Virtualization registers functional group. 


63 0 


VMPIDR 


Figure B2-95 VMPIDR_EL2 bit assignments 
VMPIDR, [63:0] 


MPIDR value returned by Non-secure EL1 reads of the MPIDR_EL1. The MPIDR description 
defines the subdivision of this value. See Figure B2-77 MPIDR_ELI bit assignments 
on page B2-434. 


Configurations 


VMPIDR_EL2[31:0] is architecturally mapped to AArch32 register VMPIDR. See 
B1.89 VMPIDR, Virtualization Multiprocessor ID Register on page B1-277. 


If EL2 is not implemented, reads of this register return the value of the MPIDR_EL1, and writes 
to the register are ignored. 


RW fields in this register reset to architecturally UNKNOWN values. 
VMPIDR_EL2 resets to the value of MPIDR_EL2. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.107 VPIDR_EL2, Virtualization Processor ID Register, EL2 


B2.107 VPIDR_EL2, Virtualization Processor ID Register, EL2 
The VPIDR_EL2 holds the value of the Virtualization Processor ID. This is the value returned by Non- 
secure EL! reads of MIDR_EL1. 


Bit field descriptions 
VPIDR_EL2 is a 32-bit register, and is part of: 


¢ The Identification registers functional group. 
¢ The Virtualization registers functional group. 


31 0 


VPIDR 


Figure B2-96 VPIDR_EL2 bit assignments 


VPIDR, [31:0] 


MIDR_EL1 value returned by Non-secure EL! reads of the MIDR_EL1. The MIDR_EL1 
description defines the subdivision of this value. See Figure B2-76 MIDR_ELI bit assignments 
on page B2-433. 


Configurations 


VPIDR_EL2 is architecturally mapped to AArch32 register VPIDR. See B/.90 VPIDR, 
Virtualization Processor ID Register on page B1-278. 


If EL2 is not implemented, reads of this register return the value of the MIDR_EL1, and writes 
to the register are ignored. 


RW fields in this register reset to architecturally UNKNOWN values. 
VPIDR_EL2 resets to the value of MIDR_EL1. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.108 VSESR_EL2, Virtual SError Exception Syndrome Register 


B2.108 VSESR_EL2, Virtual SError Exception Syndrome Register 


The VSESR_EL2 provides the syndrome value reported to software on taking a virtual SError interrupt 
exception. 


Bit field descriptions 
VSESR_EL2 is a 64-bit register, and is part of : 


¢ The Exception and fault handling registers functional group. 
¢ The The Virtualization registers functional group. 


The register has two bit assignment configurations, that depend on whether the virtual SError interrupt is 

taken to EL] using AArch32 or AArch64: 

¢ Ifthe virtual SError interrupt is taken to EL] using AArch64, VSESR_EL2 provides the syndrome 
value reported in ESR_ELI. 

¢ Ifthe virtual SError interrupt is taken to EL1 using AArch32, VSESR_EL2 provides the syndrome 
values reported in DFSR bits 


VSESR_EL2 bit assignments when EL1 is using AArch32 


63 & 16 15 14 13 F 0 


AET 














RESO 
Figure B2-97 VSESR_EL2 bit assignments when EL1 is using AArch32 
RESO, [63:16] 
RESO Reserved. 
AET, [15:14] 


Asynchronous Error Type. Describes the state of the core after taking the SError interrupt 
exception. Software might use the information in the syndrome registers to determine what 
recovery might be possible. 


RESO, [13:0] 


RESO Reserved. 
VSESR_EL2 bit assignments when EL1 is using AArch64 


63 25 24:23 0 


L_Ips 
RESO 
Figure B2-98 VSESR_EL2 bit assignments when EL1 is using AArch64 


RESO, [63:25] 


RESO Reserved. 
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B2 AArch64 system registers 
B2.108 VSESR_EL2, Virtual SError Exception Syndrome Register 


IDS, [24] 


Indicates whether the deferred SError interrupt was of an IMPLEMENTATION DEFINED type. See 
ESR_EL1.IDS for a description of the functionality. 


On taking a virtual SError interrupt to EL1 using AArch64 due to HCR_EL2.VSE == 1, 
ESR_EL1[24] is set to VSESR_EL2.IDS. 


ISS, [23:0] 
Syndrome information.See ESR_EL1.ISS for a description of the functionality. 


On taking a virtual SError interrupt to EL1 using AArch32 due to HCR_EL2.VSE == 1, 
ESR_ EL! [23:0] is set to VSESR_EL2.ISS. 


Configurations 


AArch64 System register VSESR_EL2 [31:0] is architecturally mapped to AArch32 System 
register VDFSR. See B/.87 VDFSR, Virtual SError Exception Syndrome Register 
on page B1-273. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.109 VTCR_EL2, Virtualization Translation Control Register, EL2 














B2.109 VTCR_EL2Z, Virtualization Translation Control Register, EL2 
The VTCR_EL2 controls the translation table walks required for the stage 2 translation of memory 
accesses from Non-secure ELO and EL1. 
It also holds cacheability and shareability information for the accesses. 
Bit field descriptions 
VTCR_EL2 is a 32-bit register, and is part of: 
¢ The Virtualization registers functional group. 
¢ The Virtual memory control registers functional group. 
31 30 29 28 27 26 25 24 23 22 21201918 161514131211109 8 7 6 5 
HWU62 IRGNO 
HWU61 ORGNO 
HWU60 
HWU59 
HD 
HA 
VS 
RES1 
RESO 
Figure B2-99 VTCR_EL2 bit assignments 
Note 
Bits[28:25] and bits[22:21], architecturally defined, are implemented in the core. 
TGO, [15:14] 
TTBRO_EL2 granule size. The possible values are: 
Js) A4KB. 
@1 64KB. 
10 16KB. 
11 Reserved. 
All other values are not supported. 
Configurations 
VTCR_EL2 is architecturally mapped to AArch32 register VTCR. See B/.9/ VTCR, 
Virtualization Translation Control Register on page B1-279. 
RW fields in this register reset to architecturally UNKNOWN values. 
Bit fields and details that are not provided in this description are architecturally defined. See the 
Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.110 VITTBR_EL2, Virtualization Translation Table Base Register, EL2 


B2.110 VTTBR_EL2, Virtualization Translation Table Base Register, EL2 


VTTBR_EL2 holds the base address of the translation table for the stage 2 translation of memory 
accesses from Non-secure modes other than Hyp mode. 


Bit field descriptions 
VTTBR_EL2 is a 64-bit register, and is part of: 


¢ The Virtualization registers functional group. 
¢ The Virtual memory control registers functional group. 


63 48 47 2 10 
VMID BADDR 


CnP — 
RESO 


Figure B2-100 VTTBR_EL2 bit assignments 


CnP, [0] 
Common not Private. The reset value is: 


0 CnP is not supported. 


Configurations 


VTTBR_EL2 is architecturally mapped to AArch32 register VITBR. See B/.92 VITBR, 
Virtualization Translation Table Base Register on page B1-281. 


Used in conjunction with the VTCR. 
If EL2 is not implemented, this register is Reso from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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B2 AArch64 system registers 
B2.110 VITBR_EL2, Virtualization Translation Table Base Register, EL2 
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Chapter B3 
Error system registers 


This chapter describes the error registers accessed by both the AArch32 error registers and the AArch64 
error registers. 


It contains the following sections: 

¢ B3.1 Error system register summary on page B3-466. 

¢ B3.2 ERROADDR, Error Record Address Register on page B3-468. 

¢ B3.3 ERROCTLR, Error Record Control Register on page B3-469. 

¢ B3.4 ERROFR, Error Record Feature Register on page B3-471. 

¢ B3.5 ERROMISCO, Error Record Miscellaneous Register 0 on page B3-473. 

¢ B3.6 ERROMISCI, Error Record Miscellaneous Register I on page B3-475. 

¢ B3.7 ERROPFGCDNR, Error Pseudo Fault Generation Count Down Register on page B3-476. 
¢ B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control Register on page B3-477. 
¢ B3.9 ERROPFGFR, Error Pseudo Fault Generation Feature Register on page B3-479. 

¢ B3.10 ERROSTATUS, Error Record Primary Status Register on page B3-481. 
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B3 Error system registers 
B3.1 Error system register summary 


















































B3.1 Error system register summary 
This section identifies the ERRO* core error record registers accessed by both the AArch32 and AArch64 
ERX* error registers. 
The ERRO* registers are agnostic to the architectural state. For example, this means that for 
ERRSELR==0 and ERRSELR_EL1==0, ERXPFGFR and ERXPFGFR_EL1 will both access 
ERROPFGEFR. 
For those registers not described in this chapter, see the Arm® Architecture Reference Manual Armv8, for 
Armv8-A architecture profile. 
The following table describes the architectural error record registers. 
Table B3-1 Architectural error system register summary 
Register Size | Register name Access aliases from AArch32 and AArch64 
mnemonic 
ERROADDR 64 B3.2 ERROADDR, Error Record Address B1.32 ERXADDR, Selected Error Record Address 
Register on page B3-468 Register on page B1-183. 
B1.33 ERXADDR2?, Selected Error Record Address 
Register 2 on page B1-184. 
B2.42 ERXADDR_EL1, Selected Error Record Address 
Register, ELI on page B2-362 
ERROCTLR 64 B3.3 ERROCTLR, Error Record Control B1.34 ERXCTLR, Selected Error Record Control 
Register on page B3-469 Register on page B1-185. 
B1.35 ERXCTLR2, Selected Error Record Control 
Register 2 on page B1-186. 
B2.43 ERXCTLR_EL1, Selected Error Record Control 
Register, EL1 on page B2-363 
ERROFR 64 | B3.4 ERROFR, Error Record Feature Register | B1.36 ERXFR, Selected Error Record Feature Register 
on page B3-471 on page B1-187. 
B1.37 ERXFR2, Selected Error Record Feature Register 
2 on page B1-188. 
B2.44 ERXFR_EL1, Selected Error Record Feature 
Register, ELI on page B2-364 
ERROMISCO 64 B3.5 ERROMISCO, Error Record Miscellaneous | B1.38 ERXMISCO, Selected Error Miscellaneous 
Register 0 on page B3-473 Register 0 on page B1-189. 
B1.39 ERXMISC1, Selected Error Miscellaneous 
Register I on page B1-190. 
B2.45 ERXMISCO_EL1, Selected Error Record 
Miscellaneous Register 0, ELI on page B2-365 
ERROMISC1 64 B3.6 ERROMISCI1, Error Record Miscellaneous | B1.40 ERXMISC2, Selected Error Record Miscellaneous 
Register 1 on page B3-475 Register 2 on page B1-191 accesses bits [31:0] 
B1.41 ERXMISC3, Selected Error Record Miscellaneous 
Register 3 on page B1-192 accesses bits [63:32] 
B2.46 ERXMISCI1_EL1, Selected Error Record 
Miscellaneous Register 1, ELI on page B2-366 
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B3 Error system registers 
B3.1 Error system register summary 


Table B3-1 Architectural error system register summary (continued) 





















































Register Size | Register name Access aliases from AArch32 and AArch64 
mnemonic 
ERROSTATUS 32 | B3.10 ERROSTATUS, Error Record Primary B1.45 ERXSTATUS, Selected Error Record Primary 
Status Register on page B3-481 Status Register on page B1-197 
B2.50 ERXSTATUS_EL1, Selected Error Record 
Primary Status Register, EL1 on page B2-372 
The following table describes the error record registers that are IMPLEMENTATION DEFINED. 
Table B3-2 IMPLEMENTATION DEFINED error system register summary 
Register Size | Register name Access aliases from AArch32 and AArch64 
mnemonic 
ERROPFGCDNR 32 B3.7 ERROPFGCDNR, Error Pseudo Fault B1.42 ERXPFGCDNR, Selected Error Pseudo Fault 
Generation Count Down Register Generation Count Down Register on page B1-193 
B3-4 
le B2.47 ERXPFGCDNR_ELI, Selected Error Pseudo 
Fault Generation Count Down Register, EL1 
on page B2-367 
ERROPFGCTLR 32 B3.8 ERROPFGCTLR, Error Pseudo Fault B1.43 ERXPFGCTLR, Selected Error Pseudo Fault 
Generation Control Register on page B3-477 __| Generation Control Register on page B1-195 
B2.48 ERXPFGCTLR_EL1, Selected Error Pseudo 
Fault Generation Control Register, EL1 
on page B2-369 
ERROPFGFR 32 | B3.9 ERROPFGFR, Error Pseudo Fault B1.44 ERXPFGFR, Selected Pseudo Fault Generation 
Generation Feature Register on page B3-479 _ | Feature Register on page B1-196 
B2.49 ERXPFGFR_EL1, Selected Pseudo Fault 
Generation Feature Register, EL1 on page B2-371 
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B3 Error system registers 
B3.2 ERROADDR, Error Record Address Register 


B3.2 ERROADDR, Error Record Address Register 


This register is unused in the Cortex-A55 core and marked as RESO. 
Configurations 
ERROADDR resets to 0x9900000000000000. 


This register is accessible from the following registers when ERRSELR.SEL==0: 

¢ [31:0]: B1.32 ERXADDR, Selected Error Record Address Register on page B1-183. 

¢ [63:32]: B/.33 ERXADDR2, Selected Error Record Address Register 2 on page B1-184. 
¢ B2.42 ERXADDR_ELI, Selected Error Record Address Register, ELI on page B2-362. 
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B3 Error system registers 
B3.3 ERROCTLR, Error Record Control Register 


B3.3 ERROCTLR, Error Record Control Register 


The ERROCTLR contains enable bits for the node that write to this record: 


¢ Enabling error detection and correction. 

¢ Enabling an error recovery interrupt. 

¢ Enabling a fault handling interrupt. 

¢ Enabling error recovery reporting as a read or write error response. 


Bit field descriptions 


ERROCTLR is a 64-bit register and is part of the RAS registers functional group. 


63 9 8 7 43 2 1 0 


. | | | 


CFI— 





























FI 
ul 








ED— 
RESO 


Figure B3-1 ERROCTLR bit assignments 


RESO, [63:9] 


CFI, [8] 


RESO Reserved. 


Fault handling interrupt for corrected errors enable. The fault handling interrupt is generated 
when one of the standard CE counters on ERROMISCO overflows and the overflow bit is set. 
The possible values are: 
) Fault handling interrupt not generated for corrected errors. 
1 Fault handling interrupt generated for corrected errors. 
The interrupt is generated even if the error status is overwritten because the error record already 
records a higher priority error. If the node does not support this control, this bit is REso. 

Note 


This control applies to both reads and writes. 








RESO, [7:4] 


FI, [3] 


RESO Reserved. 


Fault handling interrupt enable. 


The fault handling interrupt is generated for all detected Deferred errors and Uncorrected errors. 
The possible values are: 





) Fault handling interrupt disabled. 
1 Fault handling interrupt enabled. 
UL, [2] 
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B3 Error system registers 
B3.3 ERROCTLR, Error Record Control Register 


Uncorrected error recovery interrupt enable. When enabled, the error recovery interrupt is 
generated for all detected Uncorrected errors that are not deferred. The possible values are: 





) Error recovery interrupt disabled. 
1 Error recovery interrupt enabled. 
Note 


Applies to both reads and writes. 





RESO, [1] 


ED, [0] 


RESO Reserved. 


Enable error detection. When disabled, error detection and correction is disabled on reads. Error 
correction codes are still written for writes. The possible values are: 





(7) Error detection and correction disabled. 
1 Error detection and correction enabled. 
Note 


The bit is set to 0 on Cold reset, meaning errors are not detected or corrected from Cold reset. 
This allows boot software to initialize the core without signaling errors. When the node is 
initialized, software can enable error detection. 





Configurations 


ERROCTLR resets to @xeeeee8e0e0000000. 

This register is accessible from the following registers when ERRSELR.SEL==0: 

¢ [31:0]: B/.34 ERXCTLR, Selected Error Record Control Register on page B1-185 

¢ [63:32]: B1.35 ERXCTLR2, Selected Error Record Control Register 2 on page B1-186. 
¢ B2.43 ERXCTLR_EL1, Selected Error Record Control Register, EL1 on page B2-363. 
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B3 Error system registers 
B3.4 ERROFR, Error Record Feature Register 


ERROFR, Error Record Feature Register 


The ERROFR defines which of the common architecturally-defined features are implemented and, of the 
implemented features, which are software programmable. 


Bit field descriptions 


ERROFR is a 64-bit register, and is part of the Reliability, Availability, Serviceability (RAS) registers 
functional group. 


The register is Read Only. 



































63 | 20191817161514 1211109 876543210 
RAZ/WI CEO] DUI CEC | CFI | UE | FI | Ul | DE | ED 
RP 





Figure B3-2 ERROFR bit assignments 
[63:20] 
Read-as-zero/Write ignore. 

CEO, [19:18] 

Corrected Error Overwrite. The value is: 

@bee@ Counts CE if a counter is implemented and keeps the previous error status. If the counter 

overflows, or no counter is implemented, ERROSTATUS.OF is set to 1. 

DUI, [17:16] 

Error recovery interrupt for deferred errors. The value is: 


e@bee The core does not support this feature. 


RP, [15] 
Repeat counter. The value is: 


1 A first repeat counter and a second other counter are implemented. The repeat counter is the 
same size as the primary error counter. 


CEC, [14:12] 
Corrected Error Counter. The value is: 


@be@1@ The node implements an 8-bit standard CE counter in ERROMISC0[39:32]. 
CFI, [11:10] 

Fault handling interrupt for corrected errors. The value is: 

@b1@ The node implements a control for enabling fault handling interrupts on corrected errors. 
UE, [9:8] 

In-band uncorrected error reporting. The value is: 

@b@1 The node implements in-band uncorrected error reporting, that is external aborts. 
FI, [7:6] 

Fault handling interrupt. The value is: 


@b1@ The node implements a fault handling interrupt and implements controls for enabling and 
disabling. 
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B3 Error system registers 
B3.4 ERROFR, Error Record Feature Register 
UI, [5:4] 
Error recovery interrupt for uncorrected errors. The value is: 


@b1@ The node implements an error recovery interrupt and implements controls for enabling 
and disabling. 


DE, [3:2] 
Defers Errors enable. The value is: 


@be1 
Defers Errors always enabled. 
ED, [1:0] 
Error detection and correction The value is: 


@b10 Error detection is controllable. 


Configurations 
ERROFR is accessible from the following registers when ERRSELR.SEL==0: 
¢ [31:0]: B/.36 ERXFR, Selected Error Record Feature Register on page B1-187. 
¢ [63:32]: B1.37 ERXFR2, Selected Error Record Feature Register 2 on page B1-188. 
¢ B2.44 ERXFR_ELI, Selected Error Record Feature Register, EL1 on page B2-364. 
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B3 Error system registers 
B3.5 ERROMISCO, Error Record Miscellaneous Register 0 


B3.5 ERROMISCO, Error Record Miscellaneous Register 0 


The ERROMISCO is an error syndrome register. It contains corrected error counters, information to 
identify where the error was detected, and other state information not present in the corresponding status 
and address error record registers. 


Bit field descriptions 


ERROMISCO is a 64-bit register, and is part of the Reliability, Availability, Serviceability (RAS) registers 
functional group. 


48 47 46 40 39 38 32 ca 28 27 


a 4 cy 


|_oFo L_orr 





RESO 
Figure B3-3 ERROMISCO bit assignments 
RESO, [63:47] 
RESO Reserved. 
OFO, [47] 
Other Error Count Overflow. 
Set when the other error count field overflows. The fault handling interrupt will be asserted 
when this bit is set and the corrected fault handling interrupt is enabled. 
CECO, [46:40] 
Other Error Count. 
This field is incremented on any corrected memory error that does not match the location 
(set/way/level/cache/etc) information in this register. 
OFR, [39] 
Repeat Error Count Overflow. 
Set when the repeat error count field overflows. The fault handling interrupt will be asserted 
when this bit is set and the corrected fault handling interrupt is enabled. 
CECR, [38:32] 
Repeat Error Count. 
This field is incremented on any corrected memory error that exactly matches the location 
(set/way/level/cache/etc) information in this register. 
WAY, [31:28] 
Indicates the way that contained the error. 
¢ For all RAMs in the core, only bits [31:30] are used. 
¢ For the LI instruction cache RAMs, this indicates the RAM bank rather than the way. 
RESO, [27:19] 
RESO Reserved. 
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B3 Error system registers 
B3.5 ERROMISCO, Error Record Miscellaneous Register 0 


INDX, [18:6] 

Indicates the index that contained the error. 

Upper bits of the index are unused depending on the cache size. 
RESO, [5:4] 


RESO Reserved. 


LVL, [3:1] 
Indicates the level that contained the error. The possible values are: 
@beee Level 1. 
@be01 Level 2. 

IND, [0] 


Indicates the type of cache that contained the error. The possible values are: 


@ LI data cache, unified L2 cache, or TLB. 
1 LI instruction cache. 


Configurations 
ERROMISCO resets to 0xeeeeeeeee0eee009. 
This register is accessible from the following registers when ERRSELR.SEL==0: 
¢ [31:0]: B1.38 ERXMISCO, Selected Error Miscellaneous Register 0 on page B1-189. 
¢ [63:32]: B1.39 ERXMISCI, Selected Error Miscellaneous Register I on page B1-190. 
¢ B2.45 ERXMISCO_EL1, Selected Error Record Miscellaneous Register 0, ELI 
on page B2-365. 
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B3 Error system registers 
B3.6 ERROMISC1, Error Record Miscellaneous Register 1 


B3.6 ERROMISC1, Error Record Miscellaneous Register 1 


This register is unused in the Cortex-A55 core and marked as REso. 


Configurations 

ERROMISC1 is accessible from the following registers when ERRSELR.SEL==0: 

¢ [31:0]: B/.40 ERXMISC2, Selected Error Record Miscellaneous Register 2 on page B1-191. 

¢ [63:32]: Bl.41 ERXMISC3, Selected Error Record Miscellaneous Register 3 on page B1-192. 

¢ B2.46 ERXMISCI_EL1, Selected Error Record Miscellaneous Register 1, ELI on page B2-366. 
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B3 Error system registers 
B3.7 ERROPFGCDNR, Error Pseudo Fault Generation Count Down Register 


B3.7 ERROPFGCDNR, Error Pseudo Fault Generation Count Down Register 


ERROPFGCDNR is the Cortex-A55 node register that generates one of the errors that are enabled in the 
corresponding ERROPFGCTL register. 

Bit field descriptions 

ERROPFGCDNR is a 32-bit read/write register. 


31 0 


Figure B3-4 ERROPFGCDNR bit assignments 


CDN, [31:0] 
Count Down value. The reset value of the Error Generation Counter is used for the countdown. 


Configurations 
There are no configuration options. 
ERROPFGCDNR resets to 0x00000000. 


ERROPFGCDNR is accessible from the following registers when ERRSELR.SEL==0: 

¢ B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation Count Down Register 
on page B1-193. 

¢ B2.47 ERXPFGCDNR_ELI, Selected Error Pseudo Fault Generation Count Down Register, 
EL] on page B2-367. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B3-476 
reserved. 
Non-Confidential 


B3 Error system registers 
B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control Register 


B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control Register 
The ERROPFGCTLR is the Cortex-A55 node register that enables controlled fault generation. 


Bit field descriptions 
ERROPFGCTLR is a 32-bit read/write register. 


31 30 29 76543 2 10 


L_R CcE— 
CDNEN DE 
UER 


UC 
RESO 


Figure B3-5 ERROPFGCTLR bit assignments 
CDNEN, [31] 


Count down enable. This bit controls transfers from the value held in the ERROPFGCDNR into 
the Error Generation Counter and enables this counter to start counting down. The possible 


values are: 
7) The Error Generation Counter is disabled. 
1 The value held in the ERROPFGCDNR register is transferred into the Error 


Generation Counter. The Error Generation Counter counts down. 
R, [30] 


Restartable bit. When it reaches 0, the Error Generation Counter restarts from the 
ERROPFGCDNR value or stops. The possible values are: 


) When it reaches 0, the counter stops. 


1 When it reaches 0, the counter reloads the value stored in ERROPFGCDNR and 
starts counting down again. 


RESO, [29:7] 


RESO Reserved. 





CE, [6] 
Corrected error generation enable. The possible values are: 
) No corrected error is generated. 
1 A corrected error is generated on the next instruction that could trigger such an 
error. 
DE, [5] 
Deferred Error generation enable. The possible values are: 
() No deferred error is generated. 
1 A deferred error is generated on the next instruction that could trigger such an 
error. 
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B3 Error system registers 
B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control Register 


RESO, [4] 
RESO Reserved. 
UER, [3] 


Signaled or Recoverable Error generation enable. This bit controls whether a signaled or a 
recoverable error might be generated. The possible values are: 


) No signaled or recoverable error will be generated. 


1 A signaled or a recoverable error is generated on the next instruction that could 
trigger such an error. 


RESO, [2] 


RESO Reserved. 


UG, [1] 
Uncontainable error generation enable. The possible values are: 
) No uncontainable error is generated. 
1 An uncontainable error is generated on the next instruction that could trigger such 
an error. 


[0] 


Reserved, RESO. 

Configurations 
There are no configuration notes. 
ERROPFGCTLR resets to 0xe0000000. 


ERROPFGCTLR is accessible from the following registers when ERRSELR.SEL==0: 

¢ B1.43 ERXPFGCTLR, Selected Error Pseudo Fault Generation Control Register 
on page B1-195. 

¢ B2.48 ERXPFGCTLR_ELI, Selected Error Pseudo Fault Generation Control Register, EL1 
on page B2-369. 
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B3 Error system registers 
B3.9 ERROPFGFR, Error Pseudo Fault Generation Feature Register 


B3.9 ERROPFGFR, Error Pseudo Fault Generation Feature Register 


The ERROPFGER is the Cortex-A55 node register that defines which fault generation features are 
implemented. 


Bit field descriptions 
ERROPFGER is a 32-bit read-only register. 


31 30 29 76543210 
L_R CcE— 
PFG DE 


RESO 


Figure B3-6 ERROPFGFR bit assignments 
PEG, [31] 
Pseudo Fault Generation. The possible values are: 
@ The node does not support fault injection. 
1 The node implements a fault injection mechanism. 
R, [30] 


Restartable bit. When it reaches zero, the Error Generation Counter restarts from the 
ERROPFGCDN value or stops. The possible values are: 


@ The node does not support this feature. 
1 This feature is controllable. 





[29:7] 
Reserved, RESO. 
CE, [6] 
Corrected Error generation. The possible values are: 
) The node does not support this feature. 
1 This feature is controllable. 
DE, [5] 
Deferred Error generation. The possible values are: 
) The node does not support this feature. 
1 This feature is controllable. 
UEO, [4] 
Latent or Restartable Error generation. The possible values are: 
) The node does not support this feature. 
UER, [3] 
Signaled or Recoverable Error generation. The possible values are: 
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B3 Error system registers 
B3.9 ERROPFGFR, Error Pseudo Fault Generation Feature Register 


) The node does not support this feature. 
1 This feature is controllable. 
UEU, [2] 
Unrecoverable Error generation. The possible values are: 
) The node does not support this feature. 
UC, [1] 
Uncontainable Error generation. The possible values are: 
) The node does not support this feature. 
1 This feature is controllable. 


[0] 
Reserved, RESO. 
Configurations 
There are no configuration notes. 
ERROPFGER resets to @xC@@QGO6E. 


ERROPFGEFER is accessible from the following registers when ERRSELR.SEL==0: 


¢ B1.44 ERXPFGFR, Selected Pseudo Fault Generation Feature Register on page B1-196. 
¢ B2.49 ERXPFGFR_ELI, Selected Pseudo Fault Generation Feature Register, EL1 
on page B2-371. 
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B3 Error system registers 
B3.10 ERROSTATUS, Error Record Primary Status Register 


B3.10 ERROSTATUS, Error Record Primary Status Register 
The ERROSTATUS contains information about the error record: 


¢ Whether any error has been detected. 

¢« Whether any detected error was not corrected and returned to a master. 

¢ Whether any detected error was not corrected and deferred. 

« Whether a second error of the same type was detected before software handled the first error. 
¢ Whether any error has been reported. 

¢ Whether the other error record registers contain valid information. 


Bit field descriptions 
ERROSTATUS is a 32-bit register. 





AV— L_UET 
V PN 
UE DE 
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RESO 


Figure B3-7 ERROSTATUS bit assignments 
AV, [31] 
Address Valid. The values is: 
@ ERROADDR is not valid. 


V, [30] 
Status Register valid. The possible values are: 


@ ERROSTATUS is not valid. 
1 ERROSTATUS is valid. At least one error has been recorded. 


UE, [29] 
Uncorrected error. The possible values are: 
@ No error that could not be corrected or deferred has been detected. 


1 At least one error that could not be corrected or deferred has been detected. If error recovery 
interrupts are enabled, then the interrupt signal is asserted until this bit is cleared. 


ER, [28] 
Error reported. The possible values are: 


@ No external abort has been reported. 


1 The node has reported an external abort to the master that is in access or making a 
transaction. 


OF, [27] 
Overflow. The possible values are: 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B3-481 
reserved. 
Non-Confidential 


B3 Error system registers 
B3.10 ERROSTATUS, Error Record Primary Status Register 


@¢ IfUE= 1, then no error status for an Uncorrected error has been discarded. 
« IfUE==0 and DE == 1, then no error status for a Deferred error has been discarded. 
« IfUE=0, DE = 0, and CE !== @bee, then: 
— Ifa Corrected error counter is implemented, it has not overflowed. 
— Ifno Corrected error counter is implemented, no error status for a Corrected error has 
been discarded. 


1 More than one error has occurred and so details of the other error have been discarded. 
MV, [26] 
Miscellaneous Registers Valid. The possible values are: 


@ ERROMISCO and ERROMISC1 are not valid. 


1 This bit indicates that ERROMISCO contains additional information about any error recorded 
by this record. 


CE, [25:24] 

Corrected error. The possible values are: 

e@bee No corrected errors recorded. 

@b10 At least one corrected error recorded. 
DE, [23] 

Deferred error. The possible values are: 

®@ Noerrors were deferred. 

1 At least one error was not corrected and deferred by poisoning. 
PN, [22] 

Poison. The value is: 

@ The Cortex-A55 core cannot distinguish a poisoned value from a corrupted value. 
UET, [21:20] 

Uncorrected Error Type. The value is: 


ebee Uncontainable. 


RESO, [19:16] 


RESO Reserved. 


TERR, [15:8] 
Implementation defined error code. The possible values are: 
@x@ No error, or error on other RAMs. 
ex1 Error on L1 dirty RAM. 

SERR, [7:0] 


Primary error code. The possible values are: 


@x@ No error. 

@x2 ECC error from internal data buffer. 
@x6 ECC error on cache data RAM. 

@x7 ECC error on cache tag or dirty RAM. 
@x8 Parity error on TLB data RAM. 

@x9 Parity error on TLB tag RAM. 


@x15 Deferred error from slave not supported at the consumer. For example, poisoned data 
received from a slave by a master that cannot defer the error further. 
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B3 Error system registers 
B3.10 ERROSTATUS, Error Record Primary Status Register 


Configurations 


There are no configuration notes. 
ERROSTATUS resets to 0x80000000. 


ERROSTATUS is accessible from the following registers when ERRSELR.SEL==0: 
¢ B1.45 ERXSTATUS, Selected Error Record Primary Status Register on page B1-197. 
¢ B2.50 ERXSTATUS_EL1, Selected Error Record Primary Status Register, EL1 

on page B2-372. 
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B3 Error system registers 
B3.10 ERROSTATUS, Error Record Primary Status Register 
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Chapter B4 
GIC registers 


This chapter describes the GIC registers. 


It contains the following sections: 


B4.1 CPU interface registers on page B4-487. 

B4.2 AArch32 physical GIC CPU interface system register summary on page B4-488. 

B4.3 ICC_APORO, Interrupt Controller Active Priorities Group 0 Register 0 on page B4-489. 

B4.4 ICC_AP1RO, Interrupt Controller Active Priorities Group I Register 0 on page B4-490. 

B4.5 ICC_BPRO, Interrupt Controller Binary Point Register 0 on page B4-491. 

B4.6 ICC_BPRI1, Interrupt Controller Binary Point Register I on page B4-492. 

B4.7 ICC_CTLR, Interrupt Controller Control Register on page B4-493. 

B4.8 ICC_HSRE, Interrupt Controller Hyp System Register Enable Register on page B4-495. 

B4.9 ICC_MCTLR, Interrupt Controller Monitor Control Register on page B4-497. 

B4.10 ICC_MSRE, Interrupt Controller Monitor System Register Enable Register on page B4-499. 
B4.11 ICC_SRE, Interrupt Controller System Register Enable Register on page B4-501. 

B4.12 AArch32 virtual GIC CPU interface register summary on page B4-503. 

B4.13 ICV_APORO, Interrupt Controller Virtual Active Priorities Group 0 Register 0 on page B4-504. 
B4.14 ICV_APIRO, Interrupt Controller Virtual Active Priorities Group I Register 0 on page B4-50S. 
B4.15 ICV_BPRO, Interrupt Controller Virtual Binary Point Register 0 on page B4-506. 

B4.16 ICV_BPRI, Interrupt Controller Virtual Binary Point Register I on page B4-507. 

B4.17 ICV_CTLR, Interrupt Controller Virtual Control Register on page B4-508. 

B4.18 AArch32 virtual interface control system register summary on page B4-510. 

B4.19 ICH_APORO, Interrupt Controller Hyp Active Priorities Group 0 Register 0 on page B4-511. 
B4.20 ICH_APIRO, Interrupt Controller Hyp Active Priorities Group I Register 0 on page B4-512. 
B4.21 ICH_HCR, Interrupt Controller Hyp Control Register on page B4-513. 

B4.22 ICH_VMCR, Interrupt Controller Virtual Machine Control Register on page B4-516. 

B4.23 ICH_VTR, Interrupt Controller VGIC Type Register on page B4-518. 
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B4 GIC registers 


B4.24 AArch64 physical GIC CPU interface system register summary on page B4-520. 

B4.25 ICC_APORO_EL1, Interrupt Controller Active Priorities Group 0 Register 0, EL1 

on page B4-521. 

B4.26 ICC_AP1RO_EL1, Interrupt Controller Active Priorities Group I Register 0 EL1 

on page B4-522. 

B4.27 ICC_BPRO_ELI, Interrupt Controller Binary Point Register 0, EL1 on page B4-523. 

B4.28 ICC_BPR1_EL1, Interrupt Controller Binary Point Register 1, EL1 on page B4-524. 

B4.29 ICC_CTLR_EL1, Interrupt Controller Control Register, ELI on page B4-525. 

B4.30 ICC_CTLR_EL3, Interrupt Controller Control Register, EL3 on page B4-527. 

B4.31 ICC_SRE_EUL1, Interrupt Controller System Register Enable Register, ELI on page B4-529. 
B4.32 ICC_SRE_EL2, Interrupt Controller System Register Enable register, EL2 on page B4-531. 
B4.33 ICC_SRE_EL3, Interrupt Controller System Register Enable register, EL3 on page B4-533. 
B4.34 AArch64 virtual GIC CPU interface register summary on page B4-535. 

B4.35 ICV_APORO_ELI, Interrupt Controller Virtual Active Priorities Group 0 Register 0, EL1 
on page B4-536. 

B4.36 ICV_APIRO_ELI, Interrupt Controller Virtual Active Priorities Group 1 Register 0, EL1 
on page B4-537. 

B4.37 ICV_BPRO_ELI, Interrupt Controller Virtual Binary Point Register 0, ELI on page B4-538. 
B4.38 ICV_BPR1I_EL1, Interrupt Controller Virtual Binary Point Register 1, EL1 on page B4-539. 
B4.39 ICV_CTLR_ELI, Interrupt Controller Virtual Control Register, EL1 on page B4-540. 
B4.40 AArch64 virtual interface control system register summary on page B4-542. 

B4.41 ICH_APORO_EL2, Interrupt Controller Hyp Active Priorities Group 0 Register 0, EL2 

on page B4-543. 

B4.42 ICH_APIRO_EL2, Interrupt Controller Hyp Active Priorities Group I Register 0, EL2 

on page B4-544. 

B4.43 ICH_HCR_EL2, Interrupt Controller Hyp Control Register, EL2 on page B4-545. 

B4.44 ICH _VMCR_EL2, Interrupt Controller Virtual Machine Control Register, EL2 

on page B4-548. 

B4.45 ICH_VTR_EL2, Interrupt Controller VGIC Type Register, EL2 on page B4-550. 
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B4 GIC registers 
B4.1 CPU interface registers 


B4.1 CPU interface registers 


Each CPU interface block provides the interface for the Cortex-A55 core that interfaces with a GIC 
distributor within the system. 


The Cortex-A55 core only supports system register access to the GIC CPU interface registers. The 
following table lists the three types of GIC CPU interface system registers supported in the Cortex-A55 
core. 


Table B4-1 GIC CPU interface system register types supported in the Cortex-A55 core. 














Register prefix | Register type 

ICC Physical GIC CPU interface system registers. 
ICV Virtual GIC CPU interface system registers. 
ICH Virtual interface control system registers. 














Access to virtual GIC CPU interface system registers is only possible at Non-secure EL1. 


Access to ICC registers or the equivalent ICV registers is determined by HCR_EL2. See 
B2.55 HCR_EL2, Hypervisor Configuration Register, EL2 on page B2-377. 


For more information on the CPU interface, see the Arm® Generic Interrupt Controller Architecture 
Specification. 
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B4 GIC registers 
B4.2 AArch32 physical GIC CPU interface system register summary 























B4.2 AArch32 physical GIC CPU interface system register summary 
The following table lists the AArch32 physical GIC CPU interface system registers that have 
implementation-defined bits. 
See the Arm® Generic Interrupt Controller Architecture Specification for more information and a 
complete list of AArch32 physical GIC CPU interface system registers. 
Table B4-2 AArch32 physical GIC CPU interface system register summary 
Name Op1 | CRn | CRm | Op2 | Type | Description 
ICC_APORO | 0 12 8 4 RW_ | B4.3 ICC_APORO, Interrupt Controller Active Priorities Group 0 Register 0 
on page B4-489 
ICC_AP1RO |0 12 9 0 RW_ | B4.4 ICC_APIRO, Interrupt Controller Active Priorities Group 1 Register 0 
on page B4-490 
ICC_BPRO 0 12 8 3 RW_ | B4.5 ICC_BPRO, Interrupt Controller Binary Point Register 0 on page B4-491 
ICC_BPR1 0 12 12 3 RW_ | 84.6 ICC_BPRI, Interrupt Controller Binary Point Register 1 on page B4-492 
ICC_CTLR |0 12 12 4 RW_ | B4.7 ICC_CTLR, Interrupt Controller Control Register on page B4-493 
ICC_HSRE |4 12 9 5 RW_ | B4.8 ICC_HSRE, Interrupt Controller Hyp System Register Enable Register 


on page B4-495 





ICC_MCTLR | 6 12 12 4 RW_ | B4.9ICC_MCTLR, Interrupt Controller Monitor Control Register on page B4-497 



































ICC_MSRE |6 12 12 5 RW_ | B4.10 ICC_MSRE, Interrupt Controller Monitor System Register Enable Register 
on page B4-499 
ICC_SRE 0 12 12 rs) RW_ | B4.11 ICC_SRE, Interrupt Controller System Register Enable Register 
on page B4-501 
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B4 GIC registers 
B4.3 ICC_APORO, Interrupt Controller Active Priorities Group 0 Register 0 


B4.3 ICC_APORO, Interrupt Controller Active Priorities Group 0 Register 0 


The ICC_APORO provides information about Group 0 active priorities. 


Bit field descriptions 

This register is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 


@x@eee000e No interrupt active. This is the reset value. 
@xee00e001 Interrupt active for priority exe. 
@xeeeee002 Interrupt active for priority x8. 


@x80eee000 Interrupt active for priority @xF8. 


Configurations 
There is one instance of this register that is used in both Secure and Non-secure states. 


AArch32 System register ICC_APORO is architecturally mapped to AArch64 System register 
ICC_APORO_EL1. 


Details not provided in this description are architecturally defined. See the Arm® Generic Interrupt 
Controller Architecture Specification. 
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B4 GIC registers 
B4.4 ICC_AP1R0, Interrupt Controller Active Priorities Group 1 Register 0 


B4.4 ICC_AP1R0O, Interrupt Controller Active Priorities Group 1 Register 0 


The ICC_AP1R0 provides information about Group | active priorities. 


Bit field descriptions 

This register is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 


@x@eee000e No interrupt active. This is the reset value. 
@xee00e001 Interrupt active for priority exe. 
@xeeeee002 Interrupt active for priority x8. 


@x8e9eee0ee Interrupt active for priority @xF8. 


Configurations 
There is one instance of this register that is used in both Secure and Non-secure states. 


AArch32 System register ICC_AP1R0 is architecturally mapped to AArch64 System register 
ICC_AP1RO_ELI. 


Details not provided in this description are architecturally defined. See the Arm® Architecture Reference 
Manual Armv8, for Armv8-A architecture profile. 
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B4 GIC registers 
B4.5 ICC_BPRO, Interrupt Controller Binary Point Register 0 


B4.5 ICC_BPR0O, Interrupt Controller Binary Point Register 0 


ICC_BPRO defines the point at which the priority value fields split into two parts, the group priority field 
and the subpriority field. The group priority field determines Group 0 interrupt preemption. 


Bit field descriptions 
ICC_BPR0O is a 32-bit register and is part of: 


¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


31 3 2 0 


_ErrtrtlcCtrt—“C;tCmL 


ore 


RESO 


Figure B4-1 ICC_BPR0O bit assignments 
RESO, [31:3] 


Reserved, RESO. 
BinaryPoint, [2:0] 


The value of this field controls how the 8-bit interrupt priority field is split into a group priority 
field, that determines interrupt preemption, and a subpriority field. The minimum value 
implemented is: 


@x2 
Configurations 


AArch32 System register ICC_BPRO is architecturally mapped to AArch64 System register 
ICC_BPRO_ ELI. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4.6 ICC_BPR71, Interrupt Controller Binary Point Register 1 


B4.6 ICC_BPR1, Interrupt Controller Binary Point Register 1 


ICC_BPR1 defines the point at which the priority value fields split into two parts, the group priority field 
and the subpriority field. The group priority field determines Group | interrupt preemption. 


Bit field descriptions 
ICC_BPR1 is a 32-bit register and is part of: 


¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


31 3 2 0 


_ErrtrtlcCtrt—“C;tCmL 


ore 


RESO 


Figure B4-2 ICC_BPR1 bit assignments 
RESO, [31:3] 
Reserved, RESO. 
BinaryPoint, [2:0] 


The value of this field controls how the 8-bit interrupt priority field is split into a group priority 
field, that determines interrupt preemption, and a subpriority field. 


The minimum value implemented of ICC_BPR1_ ELI Secure register is 0x2. 
The minimum value implemented of ICC_BPR1_EL1 Non-secure register is @x3. 
Configurations 


AArch32 System register ICC_BPR1 is architecturally mapped to AArch64 System register 
ICC_BPRI1 EL}. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.7 ICC_CTLR, Interrupt Controller Control Register 


B4.7 ICC_CTLR, Interrupt Controller Control Register 


ICC_CTLR controls aspects of the behavior of the GIC CPU interface and provides information about 
the features implemented. 


Bit field descriptions 

ICC_CTLR is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


31 16151413 11 10 87 65 2 1 0 








PMHE 
SEIS 
A3V 





L_CBPR 
EOlmode 





RESO 


Figure B4-3 ICC_CTLR bit assignments 
RESO, [31:16] 
Reserved, RESO. 
A3V, [15] 
Affinity 3 Valid. The value is: 


ex1 The CPU interface logic supports non-zero values of Affinity 3 in SGI generation 
System registers. 


SEIS, [14] 

SEI Support.The value is: 

@xe The CPU interface logic does not support local generation of SEIs. 
IDbits, [13:11] 

Identifier bits. The value is: 

exe The number of physical interrupt identifier bits supported is 16 bits. 

This field is an alias of ICC_CTLR_EL3.IDbits. 
PRIbits, [10:8] 

Priority bits. The value is: 

ex4 The core support 32 levels of physical priority with 5 priority bits. 
RESO, [7] 


Reserved, RESO. 





PMHE, [6] 
Priority Mask Hint Enable. This bit is an alias of ICC_CTLR_EL3.PMHE. The possible values 
are: 
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B4 GIC registers 
B4.7 ICC_CTLR, Interrupt Controller Control Register 


0 Disables use of ICC_PMR as a hint for interrupt distribution. 
Enables use of ICC_PMR as a hint for interrupt distribution. 


RESO, [5:2] 


Reserved, RESO. 


EOImode, [1] 


End of interrupt mode for the current security state. The possible values are: 


0 ICC_EOIRO and ICC_EOIR1 provide both priority drop and interrupt deactivation 
functionality. Accesses to ICC_DIR are UNPREDICTABLE. 
1 ICC_EOIRO and ICC_EOIR1 provide priority drop functionality only. ICC_DIR 


provides interrupt deactivation functionality. 


If EL3 is using AArch32, this bit is an alias of ICC_MCTLR.EOImode_ELI1 {S, NS}. 
If EL3 is using AArch64, this bit is an alias of ICC_CTLR_EL3.EOImode_EL1 {S, NS}. 


CBPR, [0] 


Common Binary Point Register. Control whether the same register is used for interrupt pre- 
emption of both Group 0 and Group | interrupt. The possible values are: 


0 ICC_BPRO determines the preemption group for Group 0 interrupts. 
ICC_BPR1 determines the preemption group for Group | interrupts. 


1 ICC_BPRO determines the preemption group for Group 0 and Group | interrupts. 


If EL3 is using AArch32, this bit is an alias of ICC_MCTLR.CBPR_EL1 {N, NS}. 

If EL3 is using AArch64, this bit is an alias of ICC_CTLR_EL3.CBPR_ELI {S, NS}. 
If GICD_CTLR.DS == 0, this bit is read-only. 

If GICD_CTLR.DS == 0, this bit is read/write. 


Configurations 


AArch32 System register ICC_CTLR (S) is architecturally mapped to AArch64 System register 
ICC_CTLR_EL] (S). 


AArch32 System register ICC_CTLR (NS) is architecturally mapped to AArch64 System 
register ICC_CTLR_ELI(NS). 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.8 ICC_HSRE, Interrupt Controller Hyp System Register Enable Register 


B4.8 ICC_HSRE, Interrupt Controller Hyp System Register Enable Register 


ICC_HSRE controls whether the System register interface or the memory-mapped interface to the GIC 
CPU interface is used for EL2. 


Bit field descriptions 

ICC_HSRE is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 
¢ The GIC control registers functional group. 


31 4 32 10 


L_SRE 
DFB 
DIB 


Enable 


RESO 


Figure B4-4 ICC_HSRE bit assignments 
RESO, [31:4] 
Reserved, RESO. 
Enable, [3] 
Enables lower Exception level access to ICC_SRE. The value is: 


@x1 Non-secure EL1 accesses to ICC_SRE do not trap to EL2. 


This bit is RAO/WI. 
DIB, [2] 
Disable IRQ bypass. The possible values are: 
@xe IRQ bypass enabled. 
@x1 IRQ bypass disabled. 


This bit is an alias of ICC_MSRE.DIB. 
DEB, [1] 

Disable FIQ bypass. The possible values are: 

exe FIQ bypass enabled. 

@x1 FIQ bypass disabled. 


This bit is an alias of ICC_MSRE.DFB. 





SRE, [0] 
System Register Enable. The value is: 
ex1 The System register interface for the current Security state is enabled. 
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B4 GIC registers 
B4.8 ICC_HSRE, Interrupt Controller Hyp System Register Enable Register 


This bit is RAO/WI. The core only supports a system register interface to the GIC CPU 
interface. 


Configurations 


AArch32 System register ICC_HSRE (S) is architecturally mapped to AArch64 System register 
ICC_SRE_EL2 (S). 

AArch32 System register ICC_HSRE (NS) is architecturally mapped to AArch64 System 
register ICC_SRE EL2 (NS). 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.9 ICC_MCTLR, Interrupt Controller Monitor Control Register 


B4.9 ICC_MCTLR, Interrupt Controller Monitor Control Register 


ICC_MCTLR controls aspects of the behavior of the GIC CPU interface and provides information about 
the features implemented. 


Bit field descriptions 

ICC_MCTLR is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 
¢ The Security registers functional group. 

¢ The GIC control registers functional group. 


31 181716151413 1110 8.765 43 2 1 0 





|_CBPR_EL1S 
CBPR_EL1NS 
EOlmode_EL3 
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EOImode_EL1NS 
RM 

PMHE 

SEIS 

A3V 

nDS 


RESO 


























Figure B4-5 ICC_MCTLR bit assignments 
RESO, [31:18] 
Reserved, RESO. 
nDS, [17] 
Disable Security not supported. Read-only and writes are ignored. The value is: 
@x1 The CPU interface logic does not support disabling of security, and requires that 


security is not disabled. 


RESO, [16] 
Reserved, RESO. 
A3V, [15] 
Affinity 3 Valid. The value is: 
ex1 The CPU interface logic supports non-zero values of the Aff3 field in SGI 
generation System registers. 
SEIS, [14] 
SEI Support. The value is: 


@x® The CPU interface logic does not support generation of SEIs. 


IDbits, [13:11] 
Identifier bits. The value is: 


exe The number of physical interrupt identifier bits supported is 16 bits. 
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B4 GIC registers 
B4.9 ICC_MCTLR, Interrupt Controller Monitor Control Register 


This field is an alias of ICC_CTLR_EL3.IDbits. 
PRIbits, [10:8] 

Priority bits. The value is: 

ex4 The core support 32 levels of physical priority with 5 priority bits. 
RESO, [7] 


Reserved, RESO. 


PMHE, [6] 
Priority Mask Hint Enable. 


RM, [5] 


SBZ. The equivalent bit in AArch64 is the Routing Modifier bit. This feature is not supported 
when EL3 is using AArch32. The value is: 


Qx®@ 
EOImode_ELINS, [4] 


EOI mode for interrupts handled at Non-secure EL1 and EL2. Controls whether a write to an 
End of Interrupt register also deactivates the interrupt. 


EOI mode for interrupts handled at Non-secure EL1 and EL2. 
EOImode_ELIS, [3] 


EOI mode for interrupts handled at Secure EL1. Controls whether a write to an End of Interrupt 
register also deactivates the interrupt. 


EOI mode for interrupts handled at Secure EL1 
EOImode_EL3, [2] 


EOI mode for interrupts handled at EL3. Controls whether a write to an End of Interrupt register 
also deactivates the interrupt. 


EOI mode for interrupts handled at EL3. 
CBPR_ELINS, [1] 
Common Binary Point Register, EL1 Non-secure. 


Control whether the same register is used for interrupt pre-emption of both Group 0 and Group 1 
Non-secure interrupts at EL] and EL2. 


CBPR_ELIS, [0] 
Common Binary Point Register, EL1 Secure. 


Control whether the same register is used for interrupt pre-emption of both Group 0 and Group 1 
Secure interrupt at EL1. 


Configurations 
This register is only accessible in Secure state. 


AArch32 System register ICC_MCTLR can be mapped to AArch64 System register 
ICC_CTLR_EL3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.10 ICC_MSRE, Interrupt Controller Monitor System Register Enable Register 


B4.10 ICC_MSRE, Interrupt Controller Monitor System Register Enable Register 


ICC_MSRE controls whether the System register interface or the memory-mapped interface to the GIC 
CPU interface is used for EL3. 


Bit field descriptions 

ICC_MSRE is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 
¢ The Security registers functional group. 

¢ The GIC control registers functional group. 


31 4 32 10 


L_SRE 
DFB 
DIB 


Enable 


RESO 


Figure B4-6 ICC_MSRE bit assignments 
RESO, [31:4] 
Reserved, RESO. 
Enable, [3] 


Enables lower Exception level access to ICC_SRE. The value is: 


@x1 Non-secure EL1 accesses to ICC_SRE do not trap to EL2. 
This bit is RAO/WI. 

DIB, [2] 
Disable IRQ bypass. The possible values are: 
@xe IRQ bypass enabled. 
@x1 IRQ bypass disabled. 

DFB, [1] 
Disable FIQ bypass. The possible values are: 
@xe FIQ bypass enabled. 
@x1 FIQ bypass disabled. 

SRE, [0] 


System Register Enable. The value is: 


ex1 The System register interface for the current Security state is enabled. 


This bit is RAO/WI. The core only supports a system register interface to the GIC CPU 
interface. 
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B4 GIC registers 
B4.10 ICC_MSRE, Interrupt Controller Monitor System Register Enable Register 


Configurations 


AArch32 System register ICC_MSRE can be mapped to AArch64 System register 
ICC_SRE_EL3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.11 ICC_SRE, Interrupt Controller System Register Enable Register 


B4.11 ICC_SRE, Interrupt Controller System Register Enable Register 


ICC_SRE controls whether the System register interface or the memory-mapped interface to the GIC 
CPU interface is used for ELO and EL1. 


Bit field descriptions 
ICC_SRE is a 32-bit register and is part of: 


¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


31 32 1 0 


L_SRE 
DFB 
DIB 


RESO 


Figure B4-7 ICC_SRE bit assignments 
RESO, [31:3] 


Reserved, RESO. 


DIB, [2] 
Disable IRQ bypass. The possible values are: 
@xe IRQ bypass enabled. 
@x1 IRQ bypass disabled. 


This bit is an alias of ICC_MSRE.DIB. 


DEB, [1] 
Disable FIQ bypass. The possible values are: 
@xe FIQ bypass enabled. 
@x1 FIQ bypass disabled. 


This bit is an alias of ICC_MSRE.DFB. 
SRE, [0] 
System Register Enable. The value is: 
ex1 The System register interface for the current Security state is enabled. 
This bit is RAO/WI. The core only supports a system register interface to the GIC CPU 
interface. 
Configurations 


AArch32 System register ICC_SRE (S) is architecturally mapped to AArch64 System register 
ICC_SRE_ELI (S). 


AArch32 System register ICC_SRE (NS) is architecturally mapped to AArch64 System register 
ICC_SRE_ELI(NS). 
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B4 GIC registers 
B4.11 ICC_SRE, Interrupt Controller System Register Enable Register 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.12 AArch32 virtual GIC CPU interface register summary 


B4.12 AArch32 virtual GIC CPU interface register summary 


The following table describes the AArch32 virtual GIC CPU interface system register that has 
implementation defined bits. 


See the Arm® Generic Interrupt Controller Architecture Specification for more information and a 
complete list of AArch32 virtual GIC CPU interface system registers. 


Table B4-3 AArch32 virtual GIC CPU interface register summary 









































Name Op1}CRn | CRm | Op2 | Type | Description 

ICV_APORO | 0 12 8 4 RW_ | B4.13 ICV_APORO, Interrupt Controller Virtual Active Priorities Group 0 Register 0 
on page B4-504 

ICV_AP1RO | 0 12 9 0 RW_ | B4.14 ICV_AP1RO, Interrupt Controller Virtual Active Priorities Group 1 Register 0 
on page B4-505 

ICV_BPRO |0 12 8 3 RW_ | B4.15 ICV_BPRO, Interrupt Controller Virtual Binary Point Register 0 
on page B4-506 

ICV_BPRI |0 12 12 3 RW_ | B4.16 ICV_BPRI1, Interrupt Controller Virtual Binary Point Register 1 
on page B4-507 

ICV_CTLR |0 12 12 4 RW_ | B4.17 ICV_CTLR, Interrupt Controller Virtual Control Register on page B4-508 
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B4 GIC registers 
B4.13 ICV_APORO, Interrupt Controller Virtual Active Priorities Group 0 Register 0 


B4.13  ICV_APORO, Interrupt Controller Virtual Active Priorities Group 0 Register 0 


The ICV_APORO register provides information about virtual Group 0 active priorities. 


Bit descriptions 

This register is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 

@x@eee0800 No interrupt active. This is the reset value. 

@x@e800001 Interrupt active for priority exe. 

@xee00e002 Interrupt active for priority x8. 


@x8eeee00e Interrupt active for priority @xF8. 


Configurations 
AArch32 System register ICV_APORO is architecturally mapped to AArch64 System register 
ICV_APORO ELI. 


Details not provided in this description are architecturally defined. See the Arm® Generic Interrupt 
Controller Architecture Specification. 





100442 0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B4-504 
reserved. 
Non-Confidential 


B4 GIC registers 
B4.14 ICV_AP1Rb0, Interrupt Controller Virtual Active Priorities Group 1 Register 0 


B4.14 ICV_AP1R0O, Interrupt Controller Virtual Active Priorities Group 1 Register 0 


The ICV_API1RO register provides information about virtual Group 0 active priorities. 


Bit descriptions 

This register is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 

@x@eee0800 No interrupt active. This is the reset value. 

@x@e800001 Interrupt active for priority exe. 

@xee00e002 Interrupt active for priority x8. 


@x8eeee00e Interrupt active for priority @xF8. 


Configurations 
AArch32 System register ICV_API1RO is architecturally mapped to AArch64 System register 
ICV_APIRO ELI. 


Details not provided in this description are architecturally defined. See the Arm® Generic Interrupt 
Controller Architecture Specification. 
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B4 GIC registers 
B4.15 ICV_BPRO, Interrupt Controller Virtual Binary Point Register 0 


B4.15 ICV_BPRO, Interrupt Controller Virtual Binary Point Register 0 


ICV_BPRO defines the point at which the priority value fields split into two parts, the group priority field 
and the subpriority field. The group priority field determines virtual Group 0 interrupt preemption. 


Bit field descriptions 
ICC_BPR0O is a 32-bit register and is part of: 


¢ The GIC system registers functional group. 
¢ The GIC virtual interface control registers functional group. 


31 3 2 0 


_rrrrlcCtt—“C;tCmL 


eee 


RESO 


Figure B4-8 ICV_BPRO bit assignments 
RESO, [31:3] 


Reserved, RESO. 
BinaryPoint, [2:0] 


The value of this field controls how the 8-bit interrupt priority field is split into a group priority 
field, that determines interrupt preemption, and a subpriority field. The minimum value 
implemented is: 


@x2 
Configurations 


AArch32 System register ICV_BPRO is architecturally mapped to AArch64 System register 
ICV_BPRO ELI. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.16 ICV_BPRY1, Interrupt Controller Virtual Binary Point Register 1 


B4.16 ICV_BPR’1, Interrupt Controller Virtual Binary Point Register 1 


ICV_BPR1 defines the point at which the priority value fields split into two parts, the group priority field 
and the subpriority field. The group priority field determines virtual Group | interrupt preemption. 


Bit field descriptions 
ICC_BPR1 is a 32-bit register and is part of: 


¢ The GIC system registers functional group. 
¢ The GIC virtual interface control registers functional group. 


31 3 2 0 


_rrrrlcCtt—“C;tCmL 
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Figure B4-9 ICV_BPR1 bit assignments 
RESO, [31:3] 
Reserved, RESO. 
BinaryPoint, [2:0] 


The value of this field controls how the 8-bit interrupt priority field is split into a group priority 
field, that determines interrupt preemption, and a subpriority field. 


The minimum value implemented of ICV_BPR1_EL1 Secure register is @x2. 
The minimum value implemented of ICV_BPR1_EL1 Non-secure register is @x3. 
Configurations 


AArch32 System register ICV_BPR1 is architecturally mapped to AArch64 System register 
ICV_BPRI1 ELI. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.17 ICV_CTLR, Interrupt Controller Virtual Control Register 


ICV_CTLR, Interrupt Controller Virtual Control Register 


ICV_CTLR controls aspects of the behavior of the GIC virtual CPU interface and provides information 
about the features implemented. 


Bit field descriptions 

ICV_CTLR is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The GIC virtual interface control registers functional group. 


31 16151413 1110 210 
a | L_yVCBPR 
| VEOImode 
RESO 


Figure B4-10 ICV_CTLR bit assignments 
RESO, [31:16] 


Reserved, RESO. 
A3V, [15] 


Affinity 3 Valid. The value is: 


ex1 The virtual CPU interface logic supports non-zero values of Affinity 3 in SGI 
generation System registers. 


SEIS, [14] 
SEI Support. The value is: 


@xe The virtual CPU interface logic does not support local generation of SEIs. 


IDbits, [13:11] 
Identifier bits. The value is: 


exe The number of physical interrupt identifier bits supported is 16 bits. 


PRibits, [10:8] 
Priority bits. The value is: 


ex4 Support 32 levels of physical priority (5 priority bits). 


RESO, [7:2] 


Reserved, RESO. 


VEOImode, [1] 


Virtual EOI mode. The possible values are: 
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B4 GIC registers 
B4.17 ICV_CTLR, Interrupt Controller Virtual Control Register 


exe ICV_EOIRO and ICV_EOIR1 provide both priority drop and interrupt deactivation 
functionality. Accesses to ICV_DIR are UNPREDICTABLE. 
ex1 ICV_EOIRO and ICV_EOIR1 provide priority drop functionality only. ICV_DIR 


provides interrupt deactivation functionality. 


VCBPR, [0] 


Common Binary Point Register. Controls whether the same register is used for interrupt 
preemption of both virtual Group 0 and virtual Group | interrupts. The possible values are: 


0 ICV_BPRO determines the preemption group for virtual Group 0 interrupts only. 
ICV_BPR1 determines the preemption group for virtual Group | interrupts. 


1 ICV_BPRO determines the preemption group for both virtual Group 0 and virtual 
Group | interrupts. 


Reads of ICV_BPRI1 return ICV_BPRO plus one, saturated to 111. Writes to 
ICV_BPR1 are ignored. 


Configurations 


AArch32 System register ICV_CTLR is architecturally mapped to AArch64 System register 
ICV_CTLR_ELI. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.18 AArch32 virtual interface control system register summary 


B4.18 AArch32 virtual interface control system register summary 


The following table lists the AArch32 virtual interface control system registers that have implementation 
defined bits. 


See the Arm® Generic Interrupt Controller Architecture Specification for more information and a 
complete list of AArch32 virtual interface control system registers. 





Name Op1 |} CRn | CRm | Op2 | Type | Description 





ICH_APORO | 4 12 8 0 RW_ | B4.19 ICH_APORO, Interrupt Controller Hyp Active Priorities Group 0 Register 0 
on page B4-511 





ICH_AP1RO | 4 12 9 0 RW_ | B4.20 ICH_AP1RO, Interrupt Controller Hyp Active Priorities Group 1 Register 0 
on page B4-512 




















ICH_HCR |4 12 11 0 RW_ | B4.21 ICH_HCR, Interrupt Controller Hyp Control Register on page B4-513 

ICH_LRO 4 12 12 0 RW | Interrupt Controller List Registers 0-3. The Cortex-A55 core implements four 

ICH LRI 4 D D 1 RW ICH_LR registers, as defined by ICH_VTR.ListRegs. Accesses to the rest of the 
= ICH_LR registers are UNDEFINED. 

ICH_LR2 4 12 12 2 RW 

ICH_LR3 4 12 12 3 RW 

ICH_VTR |4 12 11 1 RO | B4.22 ICH_VMCR, Interrupt Controller Virtual Machine Control Register 


on page B4-516 





ICH_VMCR | 4 12 11 7 RW_ | B4.23 ICH_VTR, Interrupt Controller VGIC Type Register on page B4-518 
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B4 GIC registers 
B4.19 ICH_APORO, Interrupt Controller Hyp Active Priorities Group 0 Register 0 


B4.19 ICH_APORQO, Interrupt Controller Hyp Active Priorities Group 0 Register 0 
The ICH_APORO provides information about Group 0 active priorities for EL2. 


Bit field descriptions 

This register is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 


@x@eee0e0e No interrupt active. This is the reset value. 
@xee00e001 Interrupt active for priority exe. 
@xeee0e002 Interrupt active for priority x8. 


@x8eeee00e Interrupt active for priority @xF8. 


Configurations 


AArch32 System register ICH _APORO is architecturally mapped to AArch64 System register 
ICH_APORO EL2. 


Details not provided in this description are architecturally defined. See the Arm® Generic Interrupt 
Controller Architecture Specification. 
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B4 GIC registers 
B4.20 ICH_AP1R0O, Interrupt Controller Hyp Active Priorities Group 1 Register 0 


B4.20 ICH_AP1RQ0, Interrupt Controller Hyp Active Priorities Group 1 Register 0 
The ICH_API1RO provides information about Group | active priorities for EL2. 


Bit field descriptions 

This register is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 


@x@eee0e0e No interrupt active. This is the reset value. 
@xee00e001 Interrupt active for priority exe. 
@xee00e002 Interrupt active for priority x8. 


@x8eeee00e Interrupt active for priority @xF8. 


Configurations 


AArch32 System register ICH_API1RO is architecturally mapped to AArch64 System register 
ICH_APIRO_ EL2. 


If EL2 is not implemented, this register is Reso from EL3. 


Details not provided in this description are architecturally defined. See the Arm® Generic Interrupt 
Controller Architecture Specification. 
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B4 GIC registers 
B4.21 ICH_HCR, Interrupt Controller Hyp Control Register 


B4.21  ICH_HCR, Interrupt Controller Hyp Control Register 


ICH_HCR controls the environment for VMs. 


Bit field descriptions 

ICH_HCR is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 


31 27 26 15 14 13 12 11 10 876543 2 1 0 
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Figure B4-11 ICH_HCR bit assignments 
EOIcount, [31:27] 


Number of outstanding deactivates. 


RESO, [26:15] 


Reserved, RESO. 


TDIR, [14] 
Trap Non-secure EL1 writes to ICC_DIR and ICV_DIR. The possible values are: 
exe Non-secure EL1 writes of ICC_DIR and ICV_DIR are not trapped to EL2, unless 
trapped by other mechanisms. 
ex1 Non-secure EL1 writes of ICC_DIR and ICV_DIR are trapped to EL2. 
TSE], [13] 


Trap all locally generated SEIs. The value is: 


exe Locally generated SEIs do not cause a trap to EL2. 


TALL, [12] 


Trap all Non-secure EL1 accesses to ICC_* and ICV_* System registers for Group | interrupts 
to EL2. The possible values are: 


@xe Non-Secure EL1 accesses to ICC_* and ICV_* registers for Group | interrupts 
proceed as normal. 

ex1 Non-secure EL1 accesses to ICC_* and ICV_* registers for Group | interrupts trap 
to EL2. 


TALLO, [11] 


Trap all Non-secure EL1 accesses to ICC_* and ICV_* System registers for Group 0 interrupts 
to EL2. The possible values are: 
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B4 GIC registers 
B4.21 ICH_HCR, Interrupt Controller Hyp Control Register 


exe Non-Secure EL1 accesses to ICC_* and ICV_* registers for Group 0 interrupts 
proceed as normal. 
@x1 Non-secure EL1 accesses to ICC_* and ICV_* registers for Group 0 interrupts trap 
to EL2. 
TC, [10] 


Trap all Non-secure EL1 accesses to System registers that are common to Group 0 and Group 1| 
to EL2. The possible values are: 


exe Non-secure EL1 accesses to common registers proceed as normal. 
@x1 Non-secure EL1 accesses to common registers trap to EL2. 
RESO, [9:8] 


Reserved, RESO. 


VGrp1DIE, [7] 
VM Group | Disabled Interrupt Enable. The possible values are: 
@xe Maintenance interrupt disabled. 


ex1 Maintenance interrupt signaled when ICH_VMCR.VENGI is 0. 


VGrp1EIE, [6] 
VM Group | Enabled Interrupt Enable. The possible values are: 
exe Maintenance interrupt disabled. 


ex1 Maintenance interrupt signaled when ICH_VMCR.VENGI is 1. 


VGrpODIE, [5] 
VM Group 0 Disabled Interrupt Enable. The possible values are: 
exe Maintenance interrupt disabled. 


ex1 Maintenance interrupt signaled when ICH_VMCR.VENGO is 0. 


VGrp0EIE, [4] 
VM Group 0 Enabled Interrupt Enable. The possible values are: 


exe Maintenance interrupt disabled. 
ex1 Maintenance interrupt signaled when ICH_VMCR.VENGO is 1. 
NPIE, [3] 
No Pending Interrupt Enable. The possible values are: 
exe Maintenance interrupt disabled. 
ex1 Maintenance interrupt signaled while the List registers contain no interrupts in the 


pending state. 


LRENPIE, [2] 


List Register Entry Not Present Interrupt Enable. The possible values are: 





@xe Maintenance interrupt disabled. 
ex1 Maintenance interrupt is asserted while the EOIcount field is not 0. 
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UIE, [1] 


B4 GIC registers 
B4.21 ICH_HCR, Interrupt Controller Hyp Control Register 


Underflow Interrupt Enable. The possible values are: 
exe Maintenance interrupt disabled. 
ex1 Maintenance interrupt is asserted if none, or only one, of the List register entries is 


marked as a valid interrupt. 


En, [0] 
Enable. The possible values are: 
exe Virtual CPU interface operation disabled. 
ex1 Virtual CPU interface operation enabled. 
Configurations 


AArch32 System register ICH_HSR can be mapped to AArch64 System register 
ICH_HSR_EL2. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.22 ICH_VMCR, Interrupt Controller Virtual Machine Control Register 


ICH_VMCR, Interrupt Controller Virtual Machine Control Register 


ICH_VMCR enables the hypervisor to save and restore the virtual machine view of the GIC state. 


Bit field descriptions 

ICH_VMCR is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 





31 2423 2120 1817 109 8 543210 
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Figure B4-12 ICH_VMCR bit assignments 
VPMR, [31:24] 
Virtual Priority Mask. 
This field is an alias of ICV_PMR.Priority. 


VBPRO, [23:21] 
Virtual Binary Point Register, Group 0. The minimum value is: 


@x2 This field is an alias of ICV_BPRO.BinaryPoint. 


VBPRI1, [20:18] 
Virtual Binary Point Register, Group 1. The minimum value is: 


@x3 This field is an alias of ICV_BPR1.BinaryPoint. 
[17:10] 
Reserved, RESO. 
VEOIM, [9] 
Virtual EOI mode. The possible values are: 
exe ICV_EOIRO and ICV_EOIR1 provide both priority drop and interrupt deactivation 
functionality. Accesses to ICV_DIR are UNPREDICTABLE. 
ex1 ICV_EOIRO and ICV_EOIR1 provide priority drop functionality only. ICV_DIR 


provides interrupt deactivation functionality. 


This bit is an alias of ICV_CTLR.EOImode. 





[8:5] 
Reserved, RESO. 
VCBPR, [4] 
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B4 GIC registers 
B4.22 ICH_VMCR, Interrupt Controller Virtual Machine Control Register 


Virtual Common Binary Point Register. The possible values are: 
exe ICV_BPRO determines the preemption group for virtual Group 0 interrupts only. 
ICV_BPR1 determines the preemption group for virtual Group | interrupts. 


ex1 ICV_BPRO determines the preemption group for both virtual Group 0 and virtual 
Group | interrupts. 


Reads of ICV_BPRI1 return ICV_BPRO plus one, saturated to 111. Writes to 
ICV_BPR1 are ignored. 


VFIQEn, [3] 
Virtual FIQ enable. The value is: 
@x1 Group 0 virtual interrupts are presented as virtual FIQs. 


[2] 


Reserved, RESO. 


VENGI, [1] 
Virtual Group | interrupt enable. The possible values are: 
exe Virtual Group | interrupts are disabled. 
ex1 Virtual Group | interrupts are enabled. 


This bit is an alias of ICV_IGRPEN1.Enable. 


VENGO, [0] 
Virtual Group 0 interrupt enable. The possible values are: 
exe Virtual Group 0 interrupts are disabled. 
ex1 Virtual Group 0 interrupts are enabled. 


This bit is an alias of ICV_IGRPENO.Enable. 
Configurations 


AArch32 System register ICH _VMCR can be mapped to AArch64 System register 
ICH_VMCR _EL2. 


If EL2 is not implemented, this register is Reso from EL3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.23 ICH_VTR, Interrupt Controller VGIC Type Register 


ICH_VTR, Interrupt Controller VGIC Type Register 


ICH_VTR reports supported GIC virtualization features. 


Bit field descriptions 

ICH_VTR is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 


31. 2928 2625 232221201918 5 4 0 
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Figure B4-13 ICH_VTR bit assignments 
PRIbits, [31:29] 
Priority bits. The number of virtual priority bits implemented, minus one. 


ex4 Priority implemented is 5-bit. 


PREbits, [28:26] 
The number of virtual preemption bits implemented, minus one. The value is: 


@x4 Virtual preemption implemented is 5-bit. 


IDbits, [25:23] 


The number of virtual interrupt identifier bits supported. The value is: 


exe Virtual interrupt identifier bits implemented is 16-bit. 
SEIS, [22] 

SEI Support. The value is: 

@xe The virtual CPU interface logic does not support generation of SEIs. 
A3V, [21] 


Affinity 3 Valid. The value is: 


ex1 The virtual CPU interface logic supports non-zero values of Affinity 3 in SGI 
generation System registers. 





nV4, [20] 
Direct injection of virtual interrupts not supported. The value is: 
exe The CPU interface logic supports direct injection of virtual interrupts. 
TDS, [19] 
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B4 GIC registers 
B4.23 ICH_VTR, Interrupt Controller VGIC Type Register 


Separate trapping of Non-secure EL1 writes to ICV_DIR supported. The value is: 
ex1 Implementation supports ICH _HCR.TDIR. 


RESO, [18:5] 


Reserved, RESO. 


ListRegs, [4:0] 
The number of implemented List registers, minus one. The value is: 


3 The core implements four List registers. 


Configurations 


AArch32 System register ICH_VTR is architecturally mapped to AArch64 System register 
ICH_VTR_EL2. 


If EL2 is not implemented, all bits in this register are reso from EL3, except for nV4, which is 
RES! from EL3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.24 AArch64 physical GIC CPU interface system register summary 


B4.24 AArch64 physical GIC CPU interface system register summary 


The following table lists the AArch64 physical GIC CPU interface system registers that have 
IMPLEMENTATION DEFINED bits. 


See the Arm® Generic Interrupt Controller Architecture Specification for more information and a 
complete list of AArch64 physical GIC CPU interface system registers. 


Table B4-4 AArch64 physical GIC CPU interface system register summary 





Name Op0 | Op1 | CRn | CRm | Op2 | Type | Description 





ICC_APORO EL] |3 0 12 8 4 RW_ | B4.25 ICC_APORO_EL1, Interrupt Controller Active Priorities Group 0 
Register 0, EL] on page B4-521 





ICC_AP1RO EL] |3 0 12 9 0 RW_ | B4.26 ICC_APIRO_ELI, Interrupt Controller Active Priorities Group 1 
Register 0 ELI on page B4-522 





ICC_BPRO EL1 |3 0 12 8 3 RW_ | B4.27 ICC_BPRO_ELI, Interrupt Controller Binary Point Register 0, 
ELI on page B4-523 





ICC_BPRI ELI] |3 0 12 12 3 RW_ | B4.28 ICC_BPRI1_ELI, Interrupt Controller Binary Point Register 1, 
ELI on page B4-524 





ICC_CTLR_EL1 |3 0 12 12 4 RW | B4.29ICC_CTLR_ELI, Interrupt Controller Control Register, EL1 
on page B4-525 





ICC_CTLR_EL3 |3 6 12 12 4 RW_ | B4.30 ICC_CTLR_EL3, Interrupt Controller Control Register, EL3 
on page B4-527 





ICC_SRE EL1 3 0 12 12 5 RW_ | B4.31 ICC_SRE_ELI, Interrupt Controller System Register Enable 
Register, EL] on page B4-529 





ICC_SRE EL2 3 4 12 9 5 RW | B4.32 ICC_SRE_EL2, Interrupt Controller System Register Enable 
register, EL2 on page B4-531 





ICC_SRE EL3 3 6 12 12 5 RW_ | B4.33 ICC_SRE_EL3, Interrupt Controller System Register Enable 
register, EL3 on page B4-533 
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B4 GIC registers 
B4.25 ICC_APORO_EL1, Interrupt Controller Active Priorities Group 0 Register 0, EL1 


B4.25 ICC_APORO_EL1, Interrupt Controller Active Priorities Group 0 Register 0, 
EL1 


The ICC_APORO_ ELI provides information about Group 0 active priorities. 


Bit descriptions 

This register is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 


@x@eee0eee No interrupt active. This is the reset value. 
@xee00e001 Interrupt active for priority exe. 
@xee00e002 Interrupt active for priority x8. 


@x8ee0e00e Interrupt active for priority @xF8. 


Configurations 
AArch64 System register ICC_APORO_EL] is architecturally mapped to AArch32 System 
register ICC_APORO. 


Accessibility 


The Cortex-A55 core supports 5-bit interrupt priority or 32 possible pre-emptible priorities. Accesses to 
ICC_APORO_EL]1 are UNDEFINED. 


Details not provided in this description are architecturally defined. See the Arm® Generic Interrupt 
Controller Architecture Specification. 
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B4 GIC registers 
B4.26 ICC_AP1RO_EL1, Interrupt Controller Active Priorities Group 1 Register 0 EL1 


B4.26 ICC_AP1R0_EL1, Interrupt Controller Active Priorities Group 1 Register 0 EL1 
The ICC_AP1RO_ ELI provides information about Group | active priorities. 


Bit descriptions 

This register is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 


@x@eee0800 No interrupt active. This is the reset value. 
@x@e800001 Interrupt active for priority exe. 
@xee00e002 Interrupt active for priority x8. 


@x8eeee00e Interrupt active for priority @xF8. 


Configurations 
AArch64 System register ICC_AP1RO_EL] is architecturally mapped to AArch32 System 
register ICC_APIRO. 


Accessibility 


The Cortex-A55 core supports 5-bit interrupt priority or 32 possible preemptable priorities. Accesses to 
ICC_AP1RO are UNDEFINED. 


Details not provided in this description are architecturally defined. See the Arm® Generic Interrupt 
Controller Architecture Specification. 
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B4 GIC registers 
B4.27 ICC_BPRO_EL1, Interrupt Controller Binary Point Register 0, EL1 


B4.27  ICC_BPRO_EL1, Interrupt Controller Binary Point Register 0, EL1 


ICC_BPRO_EL]1 defines the point at which the priority value fields split into two parts, the group 
priority field and the subpriority field. The group priority field determines Group 0 interrupt preemption. 


Bit field descriptions 
ICC_BPRO_ELI is a 32-bit register and is part of: 


¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


31 3 2 0 
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RESO 


Figure B4-14 ICC_BPRO_EL1 bit assignments 
RESO, [31:3] 
RESO Reserved. 
BinaryPoint, [2:0] 


The value of this field controls how the 8-bit interrupt priority field is split into a group priority 
field, that determines interrupt preemption, and a subpriority field. The minimum value that is 
implemented is: 


@x2 
Configurations 


AArch64 System register ICC_BPRO_EL1 is architecturally mapped to AArch32 System 
register ICC_BPRO. 


Virtual accesses to this register update ICH _VMCR_EL2.VBPRO. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.28 ICC_BPR1_EL1, Interrupt Controller Binary Point Register 1, EL1 


B4.28 ICC_BPR1_EL1, Interrupt Controller Binary Point Register 1, EL1 


ICC_BPR1_EL1 defines the point at which the priority value fields split into two parts, the group 
priority field and the subpriority field. The group priority field determines Group | interrupt preemption. 


Bit field descriptions 
ICC_BPRI1_ELI is a 32-bit register and is part of: 


¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


31 3 2 0 
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RESO 


Figure B4-15 ICC_BPR1_EL1 bit assignments 
RESO, [31:3] 
RESO Reserved. 
BinaryPoint, [2:0] 


The value of this field controls how the 8-bit interrupt priority field is split into a group priority 
field, that determines interrupt preemption, and a subpriority field. 


The minimum value implemented of ICC_BPR1_ ELI Secure register is 0x2. 
The minimum value implemented of ICC_BPR1_EL1 Non-secure register is @x3. 
Configurations 


AArch64 System register ICC_BPR1_EL1 (S) is architecturally mapped to AArch32 System 
register ICC_BPR1 (S). 


AArch64 System register ICC_BPR1_EL1 (NS) is architecturally mapped to AArch32 System 
register ICC_BPR1 (NS). 


Virtual accesses to this register update ICH VMCR_EL2.VBPRI. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.29 ICC_CTLR_EL1, Interrupt Controller Control Register, EL1 


B4.29 ICC_CTLR_EL1, Interrupt Controller Control Register, EL1 


ICC_CTLR_ELI controls aspects of the behavior of the GIC CPU interface and provides information 
about the features implemented. 


Bit field descriptions 

ICC_CTLR_ELI is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 

¢ The GIC control registers functional group. 


31 16151413 11 10 87 65 2 1 0 
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Figure B4-16 ICC_CTLR_EL1 bit assignments 
RESO, [31:16] 
RESO Reserved. 
A3V, [15] 
Affinity 3 Valid. The value is: 


1 The CPU interface logic supports non-zero values of Affinity 3 in SGI generation 
System registers. 


SEIS, [14] 

SEI Support. The value is: 

) The CPU interface logic does not support local generation of SEIs. 
IDbits, [13:11] 

Identifier bits. The value is: 

7) The number of physical interrupt identifier bits supported is 16 bits. 

This field is an alias of ICC_CTLR_EL3.IDbits. 
PRibits, [10:8] 

Priority bits. The value is: 

ex4 The core supports 32 levels of physical priority with 5 priority bits. 
RESO, [7] 


RESO Reserved. 





PMHE, [6] 
Priority Mask Hint Enable. This bit is an alias of ICC_CTLR_EL3.PMHE. The possible values 
are: 
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B4 GIC registers 
B4.29 ICC_CTLR_EL1, Interrupt Controller Control Register, EL1 


7) Disables use of ICC_PMR as a hint for interrupt distribution. 
1 Enables use of ICC_PMR as a hint for interrupt distribution. 
RESO, [5:2] 


RESO Reserved. 


EOImode, [1] 
End of interrupt mode for the current security state. The possible values are: 


7) ICC_EOIRO and ICC_EOIR1 provide both priority drop and interrupt deactivation 
functionality. Accesses to ICC_DIR are UNPREDICTABLE. 
1 ICC_EOIRO and ICC_EOIR1 provide priority drop functionality only. ICC_DIR 


provides interrupt deactivation functionality. 


If El3 is using AArch32, this bit is an alias of ICC_MCTLR.EOImode_EL1 {S, NS}. 
If EL3 is using AArch64, this bit is an alias of ICC_CTLR_EL3.EOImode_EL1 {S, NS}. 


CBPR, [0] 
Common Binary Point Register. Control whether the same register is used for interrupt 
preemption of both Group 0 and Group | interrupt. The possible values are: 


) ICC_BPRO determines the preemption group for Group 0 interrupts. 
ICC_BPR1 determines the preemption group for Group | interrupts. 


1 ICC_BPRO determines the preemption group for Group 0 and Group | interrupts. 


If EL3 is using AArch32, this bit is an alias of ICC_MCTLR.CBPR_EL1 {N, NS}. 
If EL3 is using AArch64, this bit is an alias of ICC_CTLR_EL3.CBPR_ELI {S, NS}. 
If GICD_CTLR.DS == 0, this bit is read-only. 
If GICD_CTLR.DS == 0, this bit is read/write. 
Configurations 


AArch64 System register ICC_CTLR_ELI (S) is architecturally mapped to AArch32 System 
register ICC_CTLR (S). 


AArch64 System register ICC_CTLR_EL1 (NS) is architecturally mapped to AArch32 System 
register ICC_CTLR(NS). 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.30 ICC_CTLR_EL3, Interrupt Controller Control Register, EL3 
































B4.30 ICC_CTLR_EL3, Interrupt Controller Control Register, EL3 
ICC_CTLR_EL3 controls aspects of the behavior of the GIC CPU interface and provides information 
about the features implemented. 
Bit field descriptions 
ICC_CTLR_EL3 is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 
¢ The Security registers functional group. 
¢ The GIC control registers functional group. 
181716151413 1110 876543210 
|_CBPR_EL1S 
CBPR_EL1NS 
EOlmode_EL3 
EOlmode_EL1S 
EOlmode_EL1NS 
RESO RM 
PMHE 
SEIS 
A3V 
nDS 
Figure B4-17 ICC_CTLR_EL3 bit assignments 
RESO, [31:18] 
RESO Reserved. 
nDS, [17] 
Disable Security not supported. Read-only and writes are 1GNoreED. The value is: 
1 The CPU interface logic does not support disabling of security, and requires that 
security is not disabled. 
RESO, [16] 
RESO Reserved. 
A3V, [15] 
Affinity 3 Valid. This bit is RAO/WI. 
SEIS, [14] 
SEI Support. The value is: 
7) The CPU interface logic does not support generation of SEIs. 
IDbits, [13:11] 
Identifier bits. The value is: 
exe The number of physical interrupt identifier bits supported is 16 bits. 
This field is an alias of ICC_CTLR_EL3.IDbits. 
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B4 GIC registers 
B4.30 ICC_CTLR_EL3, Interrupt Controller Control Register, EL3 


PRibits, [10:8] 
Priority bits. The value is: 


ex4 The core supports 32 levels of physical priority with 5 priority bits. 
Accesses to ICC_APOR{1—3} and ICC_AP1R{1—3} are UNDEFINED. 


RESO, [7] 
Reserved, RESO. 
PMHE, [6] 
Priority Mask Hint Enable. The possible values are: 
0 Disables use of ICC_PMR as a hint for interrupt distribution. 
1 Enables use of ICC_PMR as a hint for interrupt distribution. 
RM, [5] 


Routing Modifier. This bit is RAZ/WI. 

EOImode_ELINS, [4] 

EOI mode for interrupts handled at Non-secure EL1 and EL2. 

Controls whether a write to an End of Interrupt register also deactivates the interrupt. 
EOImode_ELIS, [3] 

EOI mode for interrupts handled at Secure EL1. 

Controls whether a write to an End of Interrupt register also deactivates the interrupt. 
EOImode_EL3, [2] 

EOI mode for interrupts handled at EL3. 

Controls whether a write to an End of Interrupt register also deactivates the interrupt. 
CBPR_ELINS, [1] 

Common Binary Point Register, EL1 Non-secure. 


Control whether the same register is used for interrupt preemption of both Group 0 and Group 1 
Non-secure interrupts at EL] and EL2. 


CBPR_ELIS, [0] 
Common Binary Point Register, EL1 Secure. 


Control whether the same register is used for interrupt preemption of both Group 0 and Group 1 
Secure interrupt at EL1. 


Configurations 


AArch64 System register ICC_CTLR_EL3 can be mapped to AArch32 System register 
ICC_MCTLR. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.31 ICC_SRE_EL1, Interrupt Controller System Register Enable Register, EL1 


B4.31 ICC_SRE_EL41, Interrupt Controller System Register Enable Register, EL1 


ICC_SRE_ELI controls whether the System register interface or the memory-mapped interface to the 
GIC CPU interface is used for ELO and EL1. 


Bit field descriptions 
ICC_SRE_ ELI is a 32-bit register and is part of: 


¢ The GIC system registers functional group. 
¢ The GIC control registers functional group. 


31 32 1 0 
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Figure B4-18 ICC_SRE_EL1 bit assignments 
RESO, [31:3] 


RESO Reserved. 


DIB, [2] 
Disable IRQ bypass. The possible values are: 
@xe IRQ bypass enabled. 
@x1 IRQ bypass disabled. 


This bit is an alias of ICC_SRE EL3.DIB 


DEB, [1] 
Disable FIQ bypass. The possible values are: 
@xe FIQ bypass enabled. 
@x1 FIQ bypass disabled. 


This bit is an alias of ICC_SRE EL3.DFB 
SRE, [0] 
System Register Enable. The value is: 
ex1 The System register interface for the current Security state is enabled. 
This bit is RAO/WI. The core only supports a system register interface to the GIC CPU 
interface. 
Configurations 


AArch64 System register ICC_SRE_ EL] (S) is architecturally mapped to AArch32 System 
register ICC_SRE (S). 


AArch64 System register ICC_SRE_EL1 (NS) is architecturally mapped to AArch32 System 
register ICC_SRE (NS). 
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B4 GIC registers 
B4.31 ICC_SRE_EL1, Interrupt Controller System Register Enable Register, EL1 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.32 ICC_SRE_EL2, Interrupt Controller System Register Enable register, EL2 


B4.32 ICC_SRE_EL42, Interrupt Controller System Register Enable register, EL2 


ICC_SRE_EL2 controls whether the system register interface or the memory-mapped interface to the 
GIC CPU interface is used for EL2. 


Bit field descriptions 

ICC_SRE_EL2 is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 
¢ The GIC control registers functional group. 


31 4 32 10 


L_SRE 
DFB 
DIB 


Enable 


RESO 


Figure B4-19 ICC_SRE_EL2 bit assignments 
RESO, [31:4] 
RESO Reserved. 
Enable, [3] 
Enables lower Exception level access to ICC_SRE_EL1. The value is: 
@x1 Non-secure EL1 accesses to ICC_SRE_ ELI do not trap to EL2. 


This bit is RAO/WI. 
DIB, [2] 
Disable IRQ bypass. The possible values are: 
@xe IRQ bypass enabled. 
@x1 IRQ bypass disabled. 


This bit is an alias of ICC_SRE EL3.DIB 
DEB, [1] 

Disable FIQ bypass. The possible values are: 

exe FIQ bypass enabled. 

@x1 FIQ bypass disabled. 


This bit is an alias of ICC_SRE EL3.DFB 





SRE, [0] 
System Register Enable. The value is: 
ex1 The System register interface for the current Security state is enabled. 
100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B4-531 
reserved. 


Non-Confidential 


B4 GIC registers 
B4.32 ICC_SRE_EL2, Interrupt Controller System Register Enable register, EL2 


This bit is RAO/WI. The core only supports a system register interface to the GIC CPU 
interface. 


Configurations 


AArch64 System register ICC_SRE_EL2 is architecturally mapped to AArch32 System register 
ICC_HSRE. 


If EL2 is not implemented, this register is Reso from EL3. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.33 ICC_SRE_EL3, Interrupt Controller System Register Enable register, EL3 


B4.33  ICC_SRE_EL3, Interrupt Controller System Register Enable register, EL3 


ICC_SRE_EL3 controls whether the System register interface or the memory-mapped interface to the 
GIC CPU interface is used for EL3. 


Bit field descriptions 

ICC_SRE_EL3 is a 32-bit register and is part of: 
¢ The GIC system registers functional group. 

¢ The Security registers functional group. 

¢ The GIC control registers functional group. 


31 4 32 10 
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Figure B4-20 ICC_SRE_EL3 bit assignments 
RESO, [31:4] 
RESO Reserved. 
Enable, [3] 
Enables lower Exception level access to ICC_SRE_EL1 and ICC_SRE _EL2. The value is: 


1 « Secure EL1 accesses to Secure ICC_SRE_EL1 do not trap to EL3. 
« EL2 accesses to Non-secure ICC_SRE_EL1 and ICC_SRE_EL2 do not trap to 
EL3. 
« Non-secure EL1 accesses to ICC_SRE_EL1 do not trap to EL3. 





This bit is RAO/WI. 
DIB, [2] 
Disable IRQ bypass. The possible values are: 
0 IRQ bypass enabled. 
1 IRQ bypass disabled. 
DEB, [1] 
Disable FIQ bypass. The possible values are: 
0 FIQ bypass enabled. 
1 FIQ bypass disabled. 
SRE, [0] 
System Register Enable. The value is: 
1 The System register interface for the current Security state is enabled. 
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B4 GIC registers 
B4.33 ICC_SRE_EL3, Interrupt Controller System Register Enable register, EL3 


This bit is RAO/WI. The core only supports a system register interface to the GIC CPU 
interface. 


Configurations 


AArch64 System register ICC_SRE_EL3 can be mapped to AArch32 System register 
ICC_MSRE. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.34 AArch64 virtual GIC CPU interface register summary 


B4.34 AArch64 virtual GIC CPU interface register summary 


The following table describes the AArch64 virtual GIC CPU interface system registers that have 
IMPLEMENTATION DEFINED bits. 


See the Arm® Generic Interrupt Controller Architecture Specification for more information and a 
complete list of AArch64 virtual GIC CPU interface system registers. 


Table B4-5 AArch64 virtual GIC CPU interface register summary 


















































Name Op0 | Op1 | CRn | CRm | Op2 | Type | Description 

ICV_APORO EL] | 3 0 12 8 4 RW_ | B4.35 ICV_APORO_EL1, Interrupt Controller Virtual Active Priorities 
Group 0 Register 0, EL1 on page B4-536 

ICV_AP1RO_EL1 | 3 0 12 9 0 RW_ | 84.36 ICV_APIRO_EL1, Interrupt Controller Virtual Active Priorities 
Group I Register 0, EL1 on page B4-537 

ICV_BRPO EL] |3 0 12 8 3 RW_ | B4.37 ICV_BPRO_EL1, Interrupt Controller Virtual Binary Point 
Register 0, ELI on page B4-538 

ICV_BPR1 EL] |3 0 12 12 3 RW_ | B4.38ICV_BPR1_ELI, Interrupt Controller Virtual Binary Point 
Register 1, ELI on page B4-539 

ICV_CTLR_EL1 |3 0 12 12 4 RW_ | B4.39ICV_CTLR_ELI, Interrupt Controller Virtual Control Register, 
ELI on page B4-540 
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B4 GIC registers 
B4.35 ICV_APORO_EL1, Interrupt Controller Virtual Active Priorities Group 0 Register 0, EL1 


B4.35 ICV_APORO_EL41, Interrupt Controller Virtual Active Priorities Group 0 
Register 0, EL1 


The ICV_APORO_ ELI register provides information about virtual Group 0 active priorities. 


Bit descriptions 
This register is a 32-bit register and is part of the virtual GIC system registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 

@x@ee00000 No interrupt active. This is the reset value. 

@xee00e001 Interrupt active for priority exe. 

@xeeeee002 Interrupt active for priority x8. 


@x8e9eee000 Interrupt active for priority @xF8. 


Configurations 
AArch64 System register ICV_APORO_ EL] is architecturally mapped to AArch32 System 
register ICV_APORO. 


Details that are not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.36 ICV_AP1RO_EL1, Interrupt Controller Virtual Active Priorities Group 1 Register 0, EL1 


B4.36 ICV_AP1R0_EL41, Interrupt Controller Virtual Active Priorities Group 1 
Register 0, EL1 


The ICV_AP1RO_ ELI register provides information about virtual Group | active priorities. 


Bit descriptions 
This register is a 32-bit register and is part of the virtual GIC system registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 

@x@ee00000 No interrupt active. This is the reset value. 

@xee00e001 Interrupt active for priority exe. 

@xeeeee002 Interrupt active for priority x8. 


@x8eeee000 Interrupt active for priority @xF8. 


Configurations 
AArch64 System register ICV_AP1RO_ EL] is architecturally mapped to AArch32 System 
register ICV_API1RO. 


Details that are not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.37 ICV_BPRO_EL1, Interrupt Controller Virtual Binary Point Register 0, EL1 


B4.37  ICV_BPRO_EL41, Interrupt Controller Virtual Binary Point Register 0, EL1 


ICV_BPRO_EL1 defines the point at which the priority value fields split into two parts, the group 
priority field and the subpriority field. The group priority field determines virtual Group 0 interrupt 
preemption. 


Bit field descriptions 


ICC_BPRO_EL] is a 32-bit register and is part of the virtual GIC system registers functional group. 


31 3 2 0 


SE rrtrtrt—C(tC:ts‘(‘iRRSg 


ere 


RESO 


Figure B4-21 ICV_BPRO_EL1 bit assignments 
RESO, [31:3] 
Reserved, RESO. 
BinaryPoint, [2:0] 


The value of this field controls how the 8-bit interrupt priority field is split into a group priority 
field, that determines interrupt preemption, and a subpriority field. The minimum value that is 
implemented is: 


@x2 
Configurations 


AArch64 System register ICV_BPRO ELI is architecturally mapped to AArch32 System 
register ICV_BPRO. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.38 ICV_BPR1_EL1, Interrupt Controller Virtual Binary Point Register 1, EL1 


B4.38 ICV_BPR1_EL41, Interrupt Controller Virtual Binary Point Register 1, EL1 


ICV_BPR1_ ELI defines the point at which the priority value fields split into two parts, the group 
priority field and the subpriority field. The group priority field determines virtual Group | interrupt 
preemption. 


Bit field descriptions 


ICV_BPR1_ ELI is a 32-bit register and is part of the virtual GIC system registers functional group. 


31 3 2 0 
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Figure B4-22 ICV_BPR1_EL1 bit assignments 
RESO, [31:3] 
RESO Reserved. 
BinaryPoint, [2:0] 


The value of this field controls how the 8-bit interrupt priority field is split into a group priority 
field, that determines interrupt preemption, and a subpriority field. 


The minimum value that is implemented of ICV_BPR1_ ELI Secure register is @x2. 
The minimum value that is implemented of ICV_BPR1 ELI Non-secure register is 0x3. 
Configurations 


AArch64 System register ICV_BPR1_ ELI is architecturally mapped to AArch32 System 
register ICV_BPRI. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.39 ICV_CTLR_EL1, Interrupt Controller Virtual Control Register, EL1 


B4.39 ICV_CTLR_EL41, Interrupt Controller Virtual Control Register, EL1 


ICV_CTLR_ELI controls aspects of the behavior of the GIC virtual CPU interface and provides 
information about the features implemented. 


Bit field descriptions 


ICV_CTLR_EL] is a 32-bit register and is part of the virtual GIC system registers functional group. 


31 16151413 11 10 8 7 210 


A3v— L_VvCBPR 
SEIS VEOImode 


RESO 


Figure B4-23 ICV_CTLR_EL1 bit assignments 

RESO, [31:16] 

RESO Reserved. 
A3V, [15] 

Affinity 3 Valid. The value is: 

@x1 The virtual CPU interface logic supports non-zero values of Affinity 3 in SGI 

generation System registers. 

SEIS, [14] 

SEI Support. The value is: 


@xe The virtual CPU interface logic does not support local generation of SEIs. 


IDbits, [13:11] 
Identifier bits. The value is: 


exe The number of physical interrupt identifier bits supported is 16 bits. 


PRIbits, [10:8] 

Priority bits. The value is: 

ex4 Support 32 levels of physical priority (5 priority bits). 
RESO, [7:2] 

RESO Reserved. 
VEOImode, [1] 


Virtual EOI mode. The possible values are: 


exe ICV_EOIRO_EL1 and ICV_EOIR1_ ELI provide both priority drop and interrupt 
deactivation functionality. Accesses to ICV_DIR_EL1 are UNPREDICTABLE. 
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B4 GIC registers 
B4.39 ICV_CTLR_EL1, Interrupt Controller Virtual Control Register, EL1 


@x1 ICV_EOIRO_EL1 and ICV_EOIR1_ ELI provide priority drop functionality only. 
ICV_DIR provides interrupt deactivation functionality. 
VCBPR, [0] 


Common Binary Point Register. Controls whether the same register is used for interrupt 
preemption of both virtual Group 0 and virtual Group | interrupts. The possible values are: 


0 ICV_BPRO_EL1 determines the preemption group for virtual Group 0 interrupts 
only. 


ICV_BPR1_ELI1 determines the preemption group for virtual Group | interrupts. 


1 ICV_BPRO_ ELI determines the preemption group for both virtual Group 0 and 
virtual Group | interrupts. 


Reads of ICV_BPR1_EL1 return ICV_BPRO_ ELI plus one, saturated to 111. Writes 
to ICV_BPR1 EL] are IGNoreED. 
Configurations 


AArch64 System register ICV_CTLR_ELI is architecturally mapped to AArch32 System 
register ICV_CTLR. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.40 AArch64 virtual interface control system register summary 


B4.40 AArché64 virtual interface control system register summary 


The following table lists the AArch64 virtual interface control system registers that have IMPLEMENTATION 
DEFINED bits. 


See the Arm® Generic Interrupt Controller Architecture Specification for more information and a 
complete list of AArch64 virtual interface control system registers. 


Table B4-6 AArch64 virtual interface control system register summary 


















































Name Op0 | Op1 | CRn | CRm | Op2 | Type | Description 

ICH_APORO EL] | 3 0 12 8 4 RW_ | 84.41 ICH_APORO_EL2, Interrupt Controller Hyp Active Priorities 
Group 0 Register 0, EL2 on page B4-543 

ICH_AP1RO_EL1 | 3 0 19 9 0 RW_ | B4.42 ICH_AP1RO_EL2, Interrupt Controller Hyp Active Priorities 
Group I Register 0, EL2 on page B4-544 

ICH_HCR_EL2 |3 4 12 11 0 RW_ | B4.43 ICH_HCR_EL2, Interrupt Controller Hyp Control Register, EL2 
on page B4-545 

ICH_VTR_EL2 |3 4 12 11 1 RO | B4.44 ICH_VMCR_EL2, Interrupt Controller Virtual Machine Control 
Register, EL2 on page B4-548 

ICH_VMCR_EL2 | 3 4 12 11 i RW_ | B4.45 ICH_VTR_EL2, Interrupt Controller VGIC Type Register, EL2 
on page B4-550 

100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights B4-542 


reserved. 
Non-Confidential 


B4 GIC registers 
B4.41 ICH_APORO_EL2, Interrupt Controller Hyp Active Priorities Group 0 Register 0, EL2 


B4.41 ICH_APORO_EL2, Interrupt Controller Hyp Active Priorities Group 0 Register 
0, EL2 


The ICH_APORO_EL2 provides information about Group 0 active priorities for EL2. 


Bit field descriptions 

This register is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 

@x@eee00ee No interrupt active. This is the reset value. 

@x0e000001 Interrupt active for priority exe. 

@xee00e002 Interrupt active for priority @x8. 


@x8eeee000 Interrupt active for priority @xF8. 


Configurati AArch64 System register ICH_APORO EL2 is architecturally mapped to AArch32 System 
ons register ICH_APORO. 


If EL2 is not implemented, this register is REso from EL3. 


Details that are not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.42 ICH_AP1RO_EL2, Interrupt Controller Hyp Active Priorities Group 1 Register 0, EL2 


B4.42 ICH_AP1R0_EL2, Interrupt Controller Hyp Active Priorities Group 1 Register 
0, EL2 


The ICH_AP1RO_EL2 provides information about Group | active priorities for EL2. 


Bit field descriptions 

This register is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 


The core implements 5 bits of priority with 32 priority levels, corresponding to the 32 bits [31:0] of the 
register. The possible values for each bit are: 

@x@eee00ee No interrupt active. This is the reset value. 

@x0e000001 Interrupt active for priority exe. 

@xee00e002 Interrupt active for priority @x8. 


@x8eeee000 Interrupt active for priority @xF8. 


Configurati AArch64 System register ICH_AP1RO_ EL2 is architecturally mapped to AArch32 System 
ons register ICH_AP1RO. 


If EL2 is not implemented, this register is Reso from EL3. 


Details that are not provided in this description are architecturally defined. See the Arm® Generic 
Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.43 ICH_HCR_EL2, Interrupt Controller Hyp Control Register, EL2 


B4.43  ICH_HCR_EL4Z, Interrupt Controller Hyp Control Register, EL2 
ICH_HCR_EL2 controls the environment for VMs. 


Bit field descriptions 

ICH_HCR_EL2 is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 
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Figure B4-24 ICH_HCR_EL2 bit assignments 
EOIcount, [31:27] 


Number of outstanding deactivates. 
RESO, [26:15] 
RESO Reserved. 
TDIR, [14] 
Trap Non-secure EL1 writes to ICC_DIR_EL1 and ICV_DIR_ELI. The possible values are: 


exe Non-secure EL1 writes of ICC_DIR_EL1 and ICV_DIR_ELI are not trapped to 
EL2, unless trapped by other mechanisms. 
ex1 Non-secure EL1 writes of ICC_DIR_EL1 and ICV_DIR_EL] are trapped to EL2. 
TSE], [13] 


Trap all locally generated SEIs. The value is: 
0 Locally generated SEIs do not cause a trap to EL2. 


TALL, [12] 


Trap all Non-secure EL1 accesses to ICC_* and ICV_* System registers for Group | interrupts 
to EL2. The possible values are: 


@xe Non-secure EL1 accesses to ICC_* and ICV_* registers for Group | interrupts 
proceed as normal. 

ex1 Non-secure EL1 accesses to ICC_* and ICV_* registers for Group | interrupts trap 
to EL2. 


TALLO, [11] 


Trap all Non-secure EL1 accesses to ICC_* and ICV_* System registers for Group 0 interrupts 
to EL2. The possible values are: 
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B4 GIC registers 
B4.43 ICH_HCR_EL2, Interrupt Controller Hyp Control Register, EL2 


exe Non-secure EL1 accesses to ICC_* and ICV_* registers for Group 0 interrupts 
proceed as normal. 


@x1 Non-secure EL1 accesses to ICC_* and ICV_* registers for Group 0 interrupts trap 
to EL2. 
TC, [10] 


Trap all Non-secure EL1 accesses to System registers that are common to Group 0 and Group 1| 
to EL2. The possible values are: 


exe Non-secure EL1 accesses to common registers proceed as normal. 
@x1 Non-secure EL1 accesses to common registers trap to EL2. 
RESO, [9:8] 


RESO Reserved. 


VGrp1DIE, [7] 
VM Group | Disabled Interrupt Enable. The possible values are: 
0 Maintenance interrupt disabled. 


1 Maintenance interrupt signaled when ICH _VMCR_EL2.VENGI is 0. 


VGrp1EIE, [6] 
VM Group | Enabled Interrupt Enable. The possible values are: 
0 Maintenance interrupt disabled. 


1 Maintenance interrupt signaled when ICH _VMCR_EL2.VENGI is 1. 


VGrpODIE, [5] 
VM Group 0 Disabled Interrupt Enable. The possible values are: 
0 Maintenance interrupt disabled. 


1 Maintenance interrupt signaled when ICH _VMCR_EL2.VENG0 is 0. 


VGrp0EIE, [4] 
VM Group 0 Enabled Interrupt Enable. The possible values are: 


0 Maintenance interrupt disabled. 
1 Maintenance interrupt signaled when ICH _VMCR_EL2.VENG0 is 1. 
NPIE, [3] 
No Pending Interrupt Enable. The possible values are: 
0 Maintenance interrupt disabled. 
1 Maintenance interrupt signaled while the List registers contain no interrupts in the 


pending state. 


LRENPIE, [2] 


List Register Entry Not Present Interrupt Enable. The possible values are: 





0 Maintenance interrupt disabled. 
1 Maintenance interrupt is asserted while the EOIcount field is not 0. 
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B4 GIC registers 
B4.43 ICH_HCR_EL2, Interrupt Controller Hyp Control Register, EL2 


UIE, [1] 
Underflow Interrupt Enable. The possible values are: 
0 Maintenance interrupt disabled. 
1 Maintenance interrupt is asserted if none, or only one, of the List register entries is 


marked as a valid interrupt. 


En, [0] 
Enable. The possible values are: 
0 Virtual CPU interface operation disabled. 
1 Virtual CPU interface operation enabled. 
Configurations 


AArch64 System register ICH HCR_EL2 is architecturally mapped to AArch32 System register 
ICH_HCR. 


If EL2 is not implemented, this register is REso from EL3. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.44 ICH_VMCR_EL2, Interrupt Controller Virtual Machine Control Register, EL2 


B4.44 ICH_VMCR_ELZ, Interrupt Controller Virtual Machine Control Register, EL2 


ICH_VMCR_EL2 enables the hypervisor to save and restore the virtual machine view of the GIC state. 


Bit field descriptions 

ICH_VMCR_EL2 is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 
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Figure B4-25 ICH_VMCR_EL2 bit assignments 
VPMR, [31:24] 
Virtual Priority Mask. 
This field is an alias of ICV_PMR_EL1.Priority. 


VBPRO, [23:21] 
Virtual Binary Point Register, Group 0. The minimum value is: 
@x2 This field is an alias of ICV_BPRO_ EL1.BinaryPoint. 


VBPRI1, [20:18] 
Virtual Binary Point Register, Group 1. The minimum value is: 


@x3 This field is an alias of ICV_BPR1_ EL1.BinaryPoint. 


RESO, [17:10] 


RESO Reserved. 


VEOIM, [9] 
Virtual EOI mode. The possible values are: 
exe ICV_EOIRO_EL1 and ICV_EOIR1_ ELI provide both priority drop and interrupt 
deactivation functionality. Accesses to ICV_DIR_EL1 are UNPREDICTABLE. 
ex1 ICV_EOIRO_EL1 and ICV_EOIRI1_ ELI provide priority drop functionality only. 


ICV_DIR_EL1 provides interrupt deactivation functionality. 


This bit is an alias of ICV_CTLR_EL1.EOImode. 
RESO, [8:5] 


RESO Reserved. 


VCBPR, [4] 
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B4 GIC registers 
B4.44 ICH_VMCR_EL2, Interrupt Controller Virtual Machine Control Register, EL2 


Virtual Common Binary Point Register. The possible values are: 


exe ICV_BPRO_EL1 determines the preemption group for virtual Group 0 interrupts 
only. 


ICV_BPR1_ ELI determines the preemption group for virtual Group | interrupts. 


ex1 ICV_BPRO_EL1 determines the preemption group for both virtual Group 0 and 
virtual Group | interrupts. 


Reads of ICV_BPR1_EL1 return ICV_BPRO_ ELI plus one, saturated to 111. Writes 
to ICV_BPR1_ EL] are IGNoreED. 
VFIQEn, [3] 
Virtual FIQ enable. The value is: 


@x1 Group 0 virtual interrupts are presented as virtual FIQs. 


RESO, [2] 


RESO Reserved. 


VENGI, [1] 

Virtual Group | interrupt enable. The possible values are: 

exe Virtual Group | interrupts are disabled. 

ex1 Virtual Group | interrupts are enabled. 
VENGO, [0] 

Virtual Group 0 interrupt enable. The possible values are: 

exe Virtual Group 0 interrupts are disabled. 

ex1 Virtual Group 0 interrupts are enabled. 
Configurations 


AArch64 System register ICH _VMCR_EL2 is architecturally mapped to AArch32 System 
register ICH _VMCR. 


If EL2 is not implemented, this register is Reso from EL3. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.45 ICH_VTR_EL2, Interrupt Controller VGIC Type Register, EL2 


ICH_VTR_EL4Z2, Interrupt Controller VGIC Type Register, EL2 


ICH_VTR_EL2 reports supported GIC virtualization features. 


Bit field descriptions 

ICH_VTR_EL2 is a 32-bit register and is part of: 

¢ The GIC system registers functional group. 

¢ The Virtualization registers functional group. 

¢ The GIC host interface control registers functional group. 


31. 2928 2625 232221201918 5 4 0 
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Figure B4-26 ICH_VTR_EL2 bit assignments 
PRIbits, [31:29] 
Priority bits. The number of virtual priority bits implemented, minus one. 


ex4 Priority implemented is 5-bit. 


PREbits, [28:26] 
The number of virtual preemption bits implemented, minus one. The value is: 


@x4 Virtual preemption implemented is 5-bit. 


IDbits, [25:23] 


The number of virtual interrupt identifier bits supported. The value is: 


exe Virtual interrupt identifier bits that are implemented is 16-bit. 
SEIS, [22] 

SEI Support. The value is: 

@xe The virtual CPU interface logic does not support generation of SEIs. 
A3V, [21] 


Affinity 3 Valid. The value is: 


ex1 The virtual CPU interface logic supports non-zero values of Affinity 3 in SGI 
generation System registers. 





nV4, [20] 
Direct injection of virtual interrupts not supported. The value is: 
exe The CPU interface logic supports direct injection of virtual interrupts. 
TDS, [19] 
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B4 GIC registers 
B4.45 ICH_VTR_EL2, Interrupt Controller VGIC Type Register, EL2 


Separate trapping of Non-secure EL1 writes to ICV_DIR_EL1 supported. The value is: 
ex1 Implementation supports ICH HCR_EL2.TDIR. 


RESO, [18:5] 
RESO Reserved. 
ListRegs, [4:0] 
@x3 The number of implemented List registers, minus one. 
The core implements 4 list registers. Accesses to ICH_LR_EL2[x] (x>3) in 
AArch64 or ICH_LR[x]/ICH_LRC[x] (x>3) are UNDEFINED. 
Configurations 


AArch64 System register ICH_VTR_EL2 is architecturally mapped to AArch32 System register 
ICH_VTR. 


If EL2 is not implemented, all bits in this register are rEso from EL3, except for nV4, which is 
RES! from EL3. 


Bit fields and details that are not provided in this description are architecturally defined. See the Arm® 
Generic Interrupt Controller Architecture Specification. 
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B4 GIC registers 
B4.45 ICH _VTR_EL2, Interrupt Controller VGIC Type Register, EL2 
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Part C 


Debug descriptions 


Chapter C1 
Debug 


This chapter describes the debug features of the core. 


It contains the following sections: 

¢ Cl.1 About debug methods on page C1-556. 

¢ Cl.2 Debug functional description on page C1-557. 
¢ C1.3 Debug register interfaces on page C1-559. 

¢ C1.4 Debug events on page C1-561. 

¢ C1.5 External debug interface on page C1-562. 
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C1 Debug 
C1.1 About debug methods 


C1.1 About debug methods 


The core is part of a debug system and supports both self-hosted and external debug. 


The following figure shows a typical external debug system. 


























Debug host Protocol Debug target 
converter >| 
Core 
| 
Debug 
unit 























Figure C1-1 External debug system 


Debug host 
A computer, for example a personal computer, that is running a software debugger such as the 
DS-5 Debugger. With the debug host, you can issue high-level commands, such as setting a 
breakpoint at a certain location or examining the contents of a memory address. 


Protocol converter 
The debug host sends messages to the debug target using an interface such as Ethernet. 
However, the debug target typically implements a different interface protocol. A device such as 
DSTREAM is required to convert between the two protocols. 


Debug target 


The lowest level of the system implements system support for the protocol converter to access 
the debug unit using the Advanced Peripheral Bus (APB) slave interface. An example of a 
debug target is a development system with a test chip or a silicon part with a core. 


Debug unit 
Helps debugging software that is running on the core: 


¢ Hardware systems that are based on the core. 
* Operating systems. 
¢ Application software. 


With the debug unit, you can: 

¢ Stop program execution. 

¢ Examine and alter process and coprocessor state. 

¢ Examine and alter memory and the state of the input or output peripherals. 
¢ Restart the core. 


For self-hosted debug, the debug target runs additional debug monitor software that runs on the Cortex- 
A55 core itself. This way, it does not require expensive interface hardware to connect a second host 
computer. 
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C1 Debug 
C1.2 Debug functional description 


C1.2 Debug functional description 


This section describes the trace, debug, and test features supported by Cortex-A55. It includes Armv8-A 
Debug, CoreSight Debug, and cache Debug. 


Arm®v8-A debug architecture support 
The Cortex-A55 core supports the Armv8-A debug architecture. 


The core allows access to the internal debug functionality and registers either through a memory-mapped 
area on the external AMBA APBv3 slave port, or by using CP14 system coprocessor operations from 
software running on the core. 


The core implements six hardware breakpoints, four watchpoints, and a Debug Communications Channel 
(DCC). Four of the breakpoints match only against virtual address, the other two breakpoints match 
against either virtual address or context ID. All watchpoints can be linked to either of the virtual address 
or context-ID matching breakpoints to allow a memory request to be trapped in a given process context. 


Note 
Armv7 debug map support 


For backwards compatibility, and to reduce the address space required for the debug map, a 4k 
page-based memory map is also supported. 








CoreSight debug 


The Cortex-A55 core integrates several CoreSight debug related components to aid system debug in 
conjunction with CoreSight SoC. 


These components include: 


¢ Per-core Embedded Trace Macrocell (ETM). 

¢ Per-core Cross Trigger Interface (CTI). 

* Cross Trigger Matrix (CTM). 

¢ Debug-over-power-down support. 

The following figure shows the Cortex-A55 CoreSight debug components. 
Note 


The DAP connection is shown for completeness. 
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C1 Debug 
C1.2 Debug functional description 
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Figure C1-2 Cortex-A55 debug components 


The debug components are split into two groups. Some components are in the cluster itself and the rest 
are in a separate block named the DebugBlock. It allows you to put the DebugBlock in a separate power 
domain and place it physically with other CoreSight logic in the SoC, rather than close to the cluster. 


The connection between the cluster and the DebugBlock consists of a pair of APB interfaces, one in each 
direction. All debug traffic, except the authentication interface, takes place over this interface as read or 
write APB transactions. It includes register reads, writes, and CTI triggers. 


All debug components are controlled through the primary Debug APB interface on the DebugBlock, and 
form a standard CoreSight interface. Requests on this bus are decoded by the APB decoder before being 

sent to the appropriate component in the DebugBlock or in the cluster. The per-core CTIs are connected 

to a CoreSight CTM. 


Each core contains an ETM, PMU, and debug component that are accessed using the debug APB bus. 
This block conforms to the Armv8-A Debug Architecture Specification. 


The core supports debug-over-power-down using modules contained in the DebugBlock that mirror key 
core information such as core ID. These allow the JTAG scan chain connection to be maintained while 
the core is powered down. 


The ETM in each core outputs trace on a 32-bit AMBA 4 ATBv1.1 interface. There is one interface per 
core. 
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C1 Debug 
C1.3 Debug register interfaces 


C1.3 Debug register interfaces 
The core implements the Armv8-A Debug architecture and debug events. 
They are described in the Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The Debug architecture defines a set of debug registers. The debug register interfaces provide access to 
these registers from: 

¢ Software running on the core. 

« An external debugger. 


C1.3.1 Core interfaces 
System register access allows the core to directly access certain debug registers. 


The external debug interface enables both external and self-hosted debug agents to access debug 
registers. Access to the debug registers is partitioned as follows: 


Debug registers 
This function is system register based and memory-mapped. You can access the debug register 
map using the APB slave port. 


Performance monitor 
This function is system register based and memory-mapped. You can access the performance 
monitor registers using the APB slave port. 


Trace registers 

This function is memory-mapped. 
Related reference 
C1.5 External debug interface on page C1-562 


C1.3.2 Effects of resets on debug registers 
The core has the following reset signals that affect the debug registers: 


nCPUPORESET 
This signal initializes the core logic, including the debug, ETM trace unit, breakpoint, 
watchpoint logic, and performance monitors logic. This maps to a Cold reset that covers reset of 
the core logic and the integrated debug functionality. 


nCORERESET 
This signal resets some of the debug and performance monitor logic. This maps to a Warm reset 
that covers reset of the core logic. 


nPRESETDBG 
This signal initializes the shared debug APB, CTI, and CTM logic. This maps to an External 
Debug reset that covers the resetting of the external debug interface and has no impact on the 
core functionality. 
C1.3.3 External access permissions to debug registers 


External access permission to the debug registers is subject to the conditions at the time of the access. 


The following table describes the core response to accesses through the external debug interface. 
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C1 Debug 
C1.3 Debug register interfaces 


Table C1-1 External access conditions to registers 











Name | Condition Description 

Off EDPRSR.PU is 0 Core power domain is completely off, or in a low-power state where the 
core power domain registers cannot be accessed. 
If debug power is off, then all external debug and memory-mapped register 
accesses return an error. 

DLK_ | DoubleLockStatus() == TRUE OS Double Lock is locked. 


(EDPRSR.DLK is 1) 





OSLK 


OSLSR_EL1.OSLK is 1 


OS Lock is locked. 





EDAD 


AllowExternalDebugAccess() ==FALSE 


External debug access is disabled. When an error is returned because of an 
EDAD condition code, and this is the highest priority error condition, 
EDPRSR.SDAD is set to 1. Otherwise SDAD is unchanged. 








Default 








None of the conditions apply, normal access. 








The following table shows an example of external register access condition codes for access to a 
performance monitor register. To determine the access permission for the register, scan the columns from 
left to right. Stop at the first column a condition is true, the entry gives the access permission of the 


register and scanning stops. 


Table C1-2 External register condition code example 





Off | DLK | OSLK | EDAD | Default 





A ile, |e : RO 
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C1 Debug 
C1.4 Debug events 


C1.4 Debug events 
A debug event can be a software debug event or a halting debug event. 


A core responds to a debug event in one of the following ways: 
¢ Ignores the debug event. 

¢ Takes a debug exception. 

¢ Enters debug state. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for more 
information about the debug events. 


C1.4.1 Watchpoint debug events 
In the Cortex-A55 core, watchpoint debug events are always synchronous. 


Memory hint instructions and cache clean operations, except DC ZVA, DC IVAC, and DCIMVAC, do not 
generate watchpoint debug events. Store exclusive instructions generate a watchpoint debug event even 
when the check for the control of exclusive monitor fails. Atomic CAS instructions generate a 
watchpoint debug event even when the compare operation fails. 


For watchpoint debug events, except those resulting from cache maintenance operations, the value 
reported in DFAR is guaranteed to be no lower than the address of the watchpoint location rounded down 
to a multiple of 16 bytes. 


C1.4.2 Debug OS Lock 
Debug OS Lock is set by the powerup reset, nCPUPORESET. 


For normal behavior of debug events and debug register accesses, Debug OS Lock must be cleared. For 
more information, see the Arm® Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
Related reference 

C1.5 External debug interface on page C1-562 

A3.1 About clocks, resets, and input synchronization on page A3-42 
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C1 Debug 
C1.5 External debug interface 


C1.5 External debug interface 


For information about external debug interface, including debug memory map and debug signals, see the 
Arm® DynamIQ™ Shared Unit Technical Reference Manual. 
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Chapter C2 
PMU 


This chapter describes the Performance Monitor Unit (PMU). 


It contains the following sections: 

¢ (2.1 About the PMU on page C2-564. 

* C€2.2 PMU functional description on page C2-565. 

* (2.3 External register access permissions to the PMU registers on page C2-566. 
* (C2.4 PMU events on page C2-567. 

© = C2.5 PMU interrupts on page C2-583. 

* (2.6 Exporting PMU events on page C2-584. 
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C2 PMU 
C2.1 About the PMU 


C2.1 About the PMU 


The Cortex-A55 core includes performance monitors that enable you to gather various statistics on the 
operation of the core and its memory system during runtime. These provide useful information about the 
behavior of the core that you can use when debugging or profiling code. 


The PMU provides six counters. Each counter can count any of the events available in the core. The 
absolute counts recorded might vary because of pipeline effects. This has negligible effect except in 
cases where the counters are enabled for a very short time. 
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C2 PMU 
C2.2 PMU functional description 


C2.2 PMU functional description 
This section describes the functionality of the PMU. 
The PMU includes the following interfaces and counters: 


Event interface 
Events from all other units from across the design are provided to the PMU. 


System register and APB interface 
You can program the PMU registers using the system registers or the external APB interface. 


Counters 
The PMU has 32-bit counters that increment when they are enabled, based on events, and a 64- 
bit cycle counter. 


PMU register interfaces 
The Cortex-A55 core supports access to the performance monitor registers from the internal 
system register interface and a memory-mapped interface. 
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C2 PMU 
C2.3 External register access permissions to the PMU registers 


C2.3 External register access permissions to the PMU registers 
External access permission to the PMU registers is subject to the conditions at the time of the access. 


The following table describes the core response to accesses through the external debug and memory- 
mapped interfaces. 


Table C2-1 External register conditions 





Name_ | Condition Description 





Off EDPRSR.PU is 0 Core power domain is completely off, or in a low-power state where the core 
power domain registers cannot be accessed. 











DLK EDPRSR.DLK is 1 OS Double Lock is locked. 
OSLK | OSLSR_EL1.OSLK is 1 OS Lock is locked. 
EPMAD | AllowExternalPMUAccess() == FALSE | External performance monitors access is disabled. When an error is returned 


because of an EPMAD condition code, and this is the highest priority error 
condition, EDPRSR.SPMAD is set to 1. Otherwise SPMAD is unchanged. 















































Default | - None of the conditions apply, normal access. 
The following table shows an example of external register condition codes for access to a performance 
monitor register. To determine the access permission for the register, scan the columns from left to right. 
Stop at the first column whose condition is true, the entry gives the register access permission and 
scanning stops. 
Table C2-2 External register condition code example 
Off | DLK | OSLK | EPMAD | Default 
ee : : RO 
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C2.4 PMU events 


The following table shows the events that are generated and the numbers that the PMU uses to reference 
the events. The table also shows the bit position of each event on the event bus. Event reference numbers 


that are not listed are reserved. 


C2 PMU 
C2.4 PMU events 


Table C2-3 PMU events 

















Event PMU _ | Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
@xee = SW_INCR Instruction architecturally executed, condition code check pass, software 
increment. 
@xe1 [0] L1I_CACHE_ REFILL Level 1 instruction cache refill. 
This event counts any instruction fetch which misses in the cache. 
The following instructions are not counted: 
* Cache maintenance instructions. 
* Non-cacheable accesses. 
@x@2 [1] LiI_TLB_ REFILL Level 1 instruction TLB refill. 
This event counts any refill of the instruction L1 TLB from the L2 TLB. 
This includes refills which result in a translation fault. 
The following instructions are not counted: 
¢ TLB maintenance instructions. 
This event counts regardless of whether the MMU is enabled. 
8x03 [2] L1D_CACHE_ REFILL Level 1 data cache refill. 











This event counts any load or store operation or pagewalk access which 
causes data to be read from outside the L1, including accesses which do 
not allocate into L1. 


The following instructions are not counted: 

¢ Cache maintenance instructions and prefetches. 

« Stores of an entire cache line, even if they make a coherency request 
outside the L1. 

¢ Partial cache line writes which do not allocate into the L1 cache. 

« Non-cacheable accesses. 


This event counts the sum of LID CACHE REFILL RD and 
L1ID_CACHE_REFILL_WR. 
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C2 PMU 
C2.4 PMU events 


Table C2-3 PMU events (continued) 








Event PMU Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
exee [3] LID_CACHE Level 1 data cache access. 


This event counts any load or store operation or pagewalk access which 
looks up in the L1 data cache. In particular, any access which could 
count the L1D_ CACHE REFILL event causes this event to count. 


The following instructions are not counted: 
¢ Cache maintenance instructions and prefetches. 


¢« Non-cacheable accesses. 


This event counts the sum of LID CACHE RD and 
L1D_CACHE_WR. 





@x@5 [4] LID_TLB_REFILL Level 1 data TLB refill. 


This event counts any refill of the data L1 TLB from the L2 TLB. This 
includes refills which result in a translation fault. 


The following instructions are not counted: 


¢ TLB maintenance instructions. 


This event counts regardless of whether the MMU is enabled. 





8x06 [5] LD_RETIRED Instruction architecturally executed, condition code check pass, load. 
This event counts all load and prefetch instructions. 


This includes the Armv8.1-A atomic instructions, other than the ST* 
variants. 





8x07 [6] ST_RETIRED Instruction architecturally executed, condition code check pass, store. 
This event counts all store instructions and DC ZVA. 
This includes all the Armv8.1-A atomic instructions. 


The following instructions are not counted: 
¢ Store-Exclusive instructions which fail. 





8xe8 [7] INST_RETIRED Instruction architecturally executed. 


This event counts all retired instructions, including those that fail their 
condition check. 





@x@9 [8] EXC_TAKEN Exception taken. 








Ox@A [9] EXC_RETURN Instruction architecturally executed, condition code check pass, 
exception return. 
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C2 PMU 
C2.4 PMU events 


Table C2-3 PMU events (continued) 








Event PMU Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
@x@B [10] CID_WRITE_RETIRED Instruction architecturally executed, condition code check pass, write to 
CONTEXTIDR. 


This event only counts writes to CONTEXTIDR in AArch32, and via the 
CONTEXTIDR_EL1 mnemonic in AArch64. 


The following instructions are not counted: 
¢ Writes to CONTEXTIDR EL12 and CONTEXTIDR_EL2. 





@xeC [11] PC_WRITE_RETIRED Instruction architecturally executed, condition code check pass, software 
change of the PC. 


This event counts all branches taken and popped from the branch 
monitor. This excludes exception entries, debug entries, and CCFAIL 
branches. 





8x@D [12] BR_IMMED_RETIRED Instruction architecturally executed, immediate branch. 


This event counts all branches decoded as immediate branches, taken or 
not, and popped from the branch monitor. This excludes exception 
entries, debug entries, and CCFAIL branches. 





Ox@E [13] BR_RETURN_RETIRED Instruction architecturally executed, condition code check pass, 
procedure return. 





@xOF [14] UNALIGNED_LDST_RETIRED Instruction architecturally executed, condition code check pass, 
unaligned load or store. 








x10 [15] BR_MIS_PRED Mispredicted or not predicted branch speculatively executed. 


This event counts any predictable branch instruction which is 
mispredicted either due to dynamic misprediction or because the MMU 
is off and the branches are statically predicted not taken. 





@x11 - CPU_CYCLES Cycle. 





@x12 [16] BR_PRED Predictable branch speculatively executed. 


This event counts all predictable branches. 








@x13 [17] MEM_ACCESS Data memory access. 
This event counts memory accesses due to load or store instructions. 


The following instructions are not counted: 
¢ Instruction fetches. 

¢ Cache maintenance instructions. 

¢ Translation table walks or prefetches. 


This event counts the sum of MEM ACCESS _RD and 
MEM_ACCESS_WR. 
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C2 PMU 
C2.4 PMU events 


Table C2-3 PMU events (continued) 

















Event PMU _ | Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
0x14 [18] LII_CACHE Level 1 instruction cache access. 
This event counts any instruction fetch which accesses the L1 instruction 
cache. 
The following instructions are not counted: 
* Cache maintenance instructions. 
* Non-cacheable accesses. 
@x15 [19] LID_CACHE_WB Level 1 data cache Write-Back. 
This event counts any write back of data from the L1 data cache to L2 or 
L3. This counts both victim line evictions and snoops, including cache 
maintenance operations. 
The following instructions are not counted: 
¢ Invalidations which do not result in data being transferred out of the 
Ll. 
¢  Full-line writes which write to L2 without writing L1, such as write- 
streaming mode. 
@x16 [20] L2D_CACHE Level 2 data cache access. 
¢ Ifthe core is configured with a per-core L2 cache: 
This event counts any transaction from L1 which looks up in the L2 
cache, and any write-back from the L1 to the L2. Snoops from 
outside the core and cache maintenance operations are not counted. 
¢ Ifthe core is not configured with a per-core L2 cache: 
This event counts the cluster cache event, as defined by 
L3D_CACHE. 
¢ Ifthere is neither a per-core cache nor a cluster cache configured, 
then this event is not implemented. 
@x17 [21] L2D_CACHE_REFILL Level 2 data cache refill. 











¢ Ifthe core is configured with a per-core L2 cache: 


This event counts any cacheable transaction from L1 which causes 
data to be read from outside the core. L2 refills caused by stashes 
into L2 should not be counted. 

¢ Ifthe core is not configured with a per-core L2 cache: 


This event counts the cluster cache event, as defined by 
L3D_CACHE REFILL. 

¢ If there is neither a per-core cache nor a cluster cache configured, 
then this event is not implemented. 
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C2 PMU 
C2.4 PMU events 


Table C2-3 PMU events (continued) 








Event PMU | Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
0x18 [22] L2D_CACHE_WB Level 2 data cache Write-Back. 


¢ Ifthe core is configured with a per-core L2 cache: 


This event counts any write back of data from the L2 cache to 
outside the core. This includes snoops to the L2 which return data, 
regardless of whether they cause an invalidation. Invalidations from 
the L2 which do not write data outside of the core and snoops which 
return data from the L1 are not counted. 

¢ Ifthe core is not configured with a per-core L2 cache, this event is 
not implemented. 





@x19 [23] BUS ACCESS Bus access. 


This event counts for every beat of data transferred over the data 
channels between the core and the SCU. If both read and write data beats 
are transferred on a given cycle, this event is counted twice on that cycle. 


This event counts the sum of BUS_ACCESS_RD and 
BUS_ACCESS_WR. 





@x1A [24] MEMORY ERROR Local memory error. 


This event counts any correctable or uncorrectable memory error (ECC 
or parity) in the protected core RAMs. 





8x1B 5; INT_SPEC Operation speculatively executed. 
This event duplicates INST_RETIRED. 





@x1C [25] TTBR_WRITE_RETIRED Instruction architecturally executed, condition code check pass, write to 
TTBR. 


This event only counts writes to TTBRO/TTBR1 in AArch32 and 
TTBRO_EL1/TTBR1_EL1 in AArché4. 


The following instructions are not counted: 


« Accesses to TTBRO_EL12/TTBR1_EL12 or TTBRO_EL2/ 
TTBRI EL2. 





@x1D - BUS_CYCLES Bus cycles. 
This event duplicates CPU_CYCLES. 























@x1E : CHAIN Odd performance counter chain mode. 
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C2 PMU 
C2.4 PMU events 


Table C2-3 PMU events (continued) 





Event 
number 


PMU 
event 
bus 
(to 
trace) 


Event mnemonic 


Event name 





Qx20 


[26] 


L2D_CACHE ALLOCATE 


Level 2 data cache allocation without refill. 


¢ Ifthe core is configured with a per-core L2 cache: 


This event counts any full cache line write into the L2 cache which 
does not cause a linefill, including write-backs from L1 to L2 and 
full-line writes which do not allocate into L1. 

¢ Ifthe core is not configured with a per-core L2 cache: 


This event counts the cluster cache event, as defined by 
L3D_CACHE ALLOCATE. 

¢ Ifthere is neither a per-core cache nor a cluster cache configured, 
this event is not implemented. 





@x21 


[27] 


BR_RETIRED 


Instruction architecturally executed, branch. 


This event counts all branches, taken or not, popped from the branch 
monitor. This excludes exception entries, debug entries, and CCFAIL 
branches. In the Cortex-A55 core, an ISB is a branch, and even micro 
architectural ISBs are counted. 





@x22 


[28] 


BR_MIS_ PRED RETIRED 


Instruction architecturally executed, mispredicted branch. 


This event counts any branch counted by BR_RETIRED which is not 
correctly predicted and causes a pipeline flush. 





@x23 


STALL FRONTEND 


No operation issued because of the frontend. 


The counter counts on any cycle when no operations are issued due to 
the instruction queue being empty. 





@x24 


[30] 


STALL_BACKEND 


No operation issued because of the backend. 


The counter counts on any cycle when no operations are issued due to a 
pipeline stall. 





@x25 


L1D_TLB 


Level 1 data TLB access. 


This event counts any load or store operation which accesses the data L1 
TLB. If both a load and a store are executed on a cycle, this event counts 
twice. 


This event counts regardless of whether the MMU is enabled. 





@x26 








LIL TLB 





Level | instruction TLB access. 


This event counts any instruction fetch which accesses the instruction L1 
TLB. 


This event counts regardless of whether the MMU is enabled. 
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Table C2-3 PMU events (continued) 





























Event PMU _ | Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
@x29 [33] L3D_CACHE_ ALLOCATE Attributable Level 3 unified cache allocation without refill. 
¢ Ifthe core is configured with a per-core L2 cache and the cluster is 
configured with an L3 cache: 
This event counts any full cache line write into the L3 cache which 
does not cause a linefill, including write-backs from L2 to L3 and 
full-line writes which do not allocate into L2. 
¢ If either the core is configured without a per-core L2 or the cluster is 
configured without an L3 cache, this event is not implemented. 
@x2A [34] L3D_CACHE_REFILL Attributable Level 3 unified cache refill. 
¢ Ifthe core is configured with a per-core L2 cache and the cluster is 
configured with an L3 cache: 
This event counts for any cacheable read transaction returning data 
from the SCU for which the data source was outside the cluster. 
Transactions such as ReadUnique are counted here as “read” 
transactions, even though they can be generated by store instructions. 
¢ If either the core is configured without a per-core L2 or the cluster is 
configured without an L3 cache, this event is not implemented. 
@x2B [35] L3D_CACHE Attributable Level 3 unified cache access. 
¢ Ifthe core is configured with a per-core L2 cache and the cluster is 
configured with an L3 cache: 
This event counts for any cacheable read transaction returning data 
from the SCU, or for any cacheable write to the SCU. 
¢ If either the core is configured without a per-core L2 or the cluster is 
configured without an L3 cache, this event is not implemented. 
@x2D [36] L2D_TLB_REFILL Attributable Level 2 unified TLB refill. 
This event counts on any refill of the L2 TLB, caused by either an 
instruction or data access. 
This event does not count if the MMU is disabled. 
@x2F [37] L2D_TLB Attributable Level 2 unified TLB access. 
This event counts on any access to the L2 TLB (caused by a refill of any 
of the L1 TLBs). 
This event does not count if the MMU is disabled. 
8x34 [39] DTLB_WALK Access to data TLB that caused a page table walk. 
This event counts on any data access which causes L2D_TLB_ REFILL 
to count. 
8x35 [40] ITLB_WALK Access to instruction TLB that caused a page table walk. 








This event counts on any instruction access which causes 
L2D_TLB_REFILL to count. 
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Table C2-3 PMU events (continued) 



































Event PMU _ | Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
0x36 [41] LL_CACHE RD Last level cache access, read. 
¢ IfCPUECTLR.EXTLLC is set: 
This event counts any cacheable read transaction which returns a 
data source of "interconnect cache". 
¢ If CPUECTLR.EXTLLC is not set: 
This event is a duplicate of the L*D_CACHE RD event 
corresponding to the last level of cache implemented — 
L3D_CACHE RD if both per-core L2 and cluster L3 are 
implemented, L2D_ CACHE RD if only one is implemented, or 
L1D_CACHE RD if neither is implemented. 
@x37 [42] LL_CACHE MISS_RD Last level cache miss, read. 
¢ IfCPUECTLR.EXTLLC is set: 
This event counts any cacheable read transaction which returns a 
data source of "DRAM", "remote" or "inter-cluster peer". 
¢ If CPUECTLR.EXTLLC is not set: 
This event is a duplicate of the L*D_ CACHE REFILL RD event 
corresponding to the last level of cache implemented — 
L3D_CACHE_REFILL RD if both per-core L2 and cluster L3 are 
implemented, L2D CACHE REFILL _RD if only one is 
implemented, or LID CACHE REFILL RD if neither is 
implemented. 
0x38 [38] REMOTE ACCESS RD Access to another socket in a multi-socket system, read. 
This event counts any read transaction which returns a data source of 
"remote". 
0x40 : L1D_CACHE RD Level 1 data cache access, read. 
This event counts any load operation or pagewalk access which looks up 
in the L1 data cache. In particular, any access which could count the 
L1D_CACHE_ REFILL RD event causes this event to count. 
The following instructions are not counted: 
* Cache maintenance instructions and prefetches. 
* Non-cacheable accesses. 
@x41 - L1D_CACHE_WR 











Level | data cache access, write. 


This event counts any store operation which looks up in the L1 data 
cache. In particular, any access which could count the 
L1D_CACHE REFILL event causes this event to count. 


The following instructions are not counted: 


¢ Cache maintenance instructions and prefetches. 
« Non-cacheable accesses. 
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Table C2-3 PMU events (continued) 








Event PMU Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
exe . L1D_CACHE REFILL _RD Level 1 data cache refill, read. 





This event counts any load operation or pagewalk access which causes 
data to be read from outside the L1, including accesses which do not 
allocate into L1. 


The following instructions are not counted: 


¢ Cache maintenance instructions and prefetches. 
« Non-cacheable accesses. 





8x43 . L1D_CACHE_REFILL_WR Level 1 data cache refill, write. 





This event counts any store operation which causes data to be read from 
outside the L1, including accesses which do not allocate into L1. 


The following instructions are not counted: 

* Cache maintenance instructions and prefetches. 

« Stores of an entire cache line, even if they make a coherency request 
outside the L1. 

¢ Partial cache line writes which do not allocate into the L1 cache. 

« Non-cacheable accesses. 





@x44 = LID CACHE REFILL INNER Level | data cache refill, inner. 





This event counts any L1 D-cache linefill (as counted by 
L1D_CACHE_REFILL) which hits in the L2 cache, L3 cache or another 
core in the cluster. 





@x45 - LID CACHE REFILL OUTER Level | data cache refill, outer. 





This event counts any L1 D-cache linefill (as counted by 

L1D_CACHE_ REFILL) which does not hit in the L2 cache, L3 cache or 
another core in the cluster, and instead obtains data from outside the 
cluster. 





@x50 - L2D_CACHE_RD Level 2 cache access, read. 


¢ Ifthe core is configured with a per-core L2 cache: 


This event counts any read transaction from L1 which looks up in the 
L2 cache. Snoops from outside the core are not counted. 
¢ Ifthe core is configured without a per-core L2 cache: 


This event counts the cluster cache event, as defined by 
L3D_CACHE_ RD. 

¢ If there is neither a per-core cache nor a cluster cache configured, 
this event is not implemented. 
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Table C2-3 PMU events (continued) 





Event 
number 


PMU 
event 
bus 
(to 
trace) 


Event mnemonic 


Event name 





@x51 


L2D_CACHE_WR 


Level 2 cache access, write. 


¢ Ifthe core is configured with a per-core L2 cache: 


This event counts any write transaction from L1 which looks up in 
the L2 cache or any write-back from L1 which allocates into the L2 
cache. Snoops from outside the core are not counted. 

¢ Ifthe core is configured without a per-core L2 cache: 


This event counts the cluster cache event, as defined by 
L3D_CACHE_WR. 

¢  Ifthere is neither a per-core cache nor a cluster cache configured, 
this event is not implemented. 





@x52 


L2D_ CACHE REFILL RD 





Level 2 cache refill, read. 
¢ Ifthe core is configured with a per-core L2 cache: 


This event counts any cacheable read transaction from L1 which 
causes data to be read from outside the core. L2 refills caused by 
stashes into L2 should not be counted. Transactions such as 
ReadUnique are counted here as “read” transactions, even though 
they can be generated by store instructions. 

¢ Ifthe core is configured without a per-core L2 cache: 


This event counts the cluster cache event, as defined by 
L3D_ CACHE REFILL RD. 
¢ Ifthere is neither a per-core cache nor a cluster cache configured, 





this event is not implemented. 





@x53 


L2D_CACHE REFILL WR 





Level 2 cache refill, write. 
¢ Ifthe core is configured with a per-core L2 cache: 


This event counts any write transaction from L1 which causes data to 
be read from outside the core. L2 refills caused by stashes into L2 
should not be counted. Transactions such as ReadUnique are not 
counted as write transactions. 

¢ Ifthe core is configured without a per-core L2 cache: 


This event counts the cluster cache event, as defined by 
L3D_ CACHE REFILL WR. 
¢ Ifthere is neither a per-core cache nor a cluster cache configured, 





this event is not implemented. 





@x60 


BUS_ACCESS_RD 


Bus access, read. 


This event counts for every beat of data transferred over the read data 
channel between the core and the SCU. 








@x61 





BUS_ACCESS_WR 





Bus access, write. 


This event counts for every beat of data transferred over the write data 
channel between the core and the SCU. 











100442 _0200_00_en 


Copyright © 2016-2018 Arm Limited or its affiliates. All rights C2-576 


reserved. 
Non-Confidential 


C2 PMU 


C2.4 PMU events 


Table C2-3 PMU events (continued) 





Event 
number 


PMU 
event 
bus 
(to 
trace) 


Event mnemonic 


Event name 





@x66 


MEM_ACCESS RD 


Data memory access, read. 
This event counts memory accesses due to load instructions. 


The following instructions are not counted: 
¢ Instruction fetches. 

* Cache maintenance instructions. 

¢ Translation table walks. 

¢  Prefetches. 





@x67 


MEM_ACCESS WR 


Data memory access, write. 
This event counts memory accesses due to store instructions. 


The following instructions are not counted: 
¢ Instruction fetches. 

* Cache maintenance instructions. 

¢ Translation table walks. 

¢  Prefetches. 





@x70 


LD_SPEC 


Operation speculatively executed, load. 


This event duplicates LD_RETIRED. 





@x71 


ST_SPEC 


Operation speculatively executed, store. 


This event duplicates ST_RETIRED. 





@x72 


LDST_SPEC 


Operation speculatively executed, load or store. 


This event counts the sum of LD_SPEC and ST_SPEC. 





@x73 


DP_SPEC 


Operation speculatively executed, integer data processing. 


This event counts retired integer data-processing instructions. 





@x74 


ASE_SPEC 


Operation speculatively executed, Advanced SIMD instruction. 


This event counts retired Advanced SIMD instructions. 





@x75 


VFP_SPEC 


Operation speculatively executed, floating-point instruction. 


This event counts retired floating-point instructions. 





@x76 


PC_WRITE_SPEC 


Operation speculatively executed, software change of the PC. 


This event counts retired branch instructions. 





Ox77 


CRYPTO_SPEC 


Operation speculatively executed, Cryptographic instruction. 


This event counts retired Cryptographic instructions. 








@x78 





BR_IMMED_ SPEC 





Branch speculatively executed, immediate branch. 


This event duplicates BR IMMED_ RETIRED. 
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Table C2-3 PMU events (continued) 








Event PMU Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
ee . BR_RETURN_SPEC Branch speculatively executed, procedure return. 


This event duplicates BR RETURN_RETIRED. 





@x7A - BR_INDIRECT_SPEC Branch speculatively executed, indirect branch. 


This event counts retired indirect branch instructions. 











@x86 > EXC_IRQ Exception taken, IRQ. 
Qx87 - EXC_FIQ Exception taken, FIQ. 
8xA@ * L3D_CACHE_ RD Attributable Level 3 unified cache access, read. 


This event counts for any cacheable read transaction returning data from 
the SCU. 


If either the core is configured without a per-core L2 or the cluster is 
configured without an L3 cache, this event is not implemented. 





@xA2 - L3D_ CACHE REFILL RD Attributable Level 3 unified cache refill, read. 





This event duplicates L3D_ CACHE REFILL. 


If either the core is configured without a per-core L2 or the cluster is 
configured without an L3 cache, this event is not implemented. 





@xC@ - L3D_CACHE_REFILL_PREFETCH | [ evel 3 cache refill due to prefetch. 





This event counts any linefills from the hardware prefetcher which cause 
an allocation into the L3 cache. 


Note 
It might not be possible to both distinguish hardware vs software 





prefetches and also which prefetches cause an allocation. If so, only 
hardware prefetches should be counted, regardless of whether they 
allocate. 


If either the core is configured without a per-core L2 or the cluster is 
configured without an L3 cache, this event is not implemented. 








@xC1 - L2D_CACHE_ REFILL _PREFETCH | Level 2 cache refill due to prefetch. 


¢ Ifthe core is configured with a per-core L2 cache: 





This event does not count. 
¢ Ifthe core is configured without a per-core L2 cache: 


This event counts the cluster cache event, as defined by 
L3D_ CACHE REFILL PREFETCH. 
¢ Ifthere is neither a per-core cache nor a cluster cache configured, 





this event is not implemented. 
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Table C2-3 PMU events (continued) 









































Event PMU | Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
@xC2 - LID_CACHE_REFILL_PREFETCH | { evel 1 data cache refill due to prefetch. 
This event counts any linefills from the prefetcher which cause an 
allocation into the L1 D-cache. 
8xC3 . L2D_WS_MODE Level 2 cache write streaming mode. 
This event counts for each cycle where the core is in write-streaming 
mode and not allocating writes into the L2 cache. 
@xC4 - LID_WS_MODE ENTRY Level 1 data cache entering write streaming mode. 
This event counts for each entry into write-streaming mode. 
@xC5 = LID_WS_MODE Level 1 data cache write streaming mode. 
This event counts for each cycle where the core is in write-streaming 
mode and not allocating writes into the L1 D-cache. 
@xC6 - PREDECODE ERROR Predecode error. 
@xC7 : L3D_WS_MODE Level 3 cache write streaming mode. 
This event counts for each cycle where the core is in write-streaming 
mode and not allocating writes into the L3 cache. 
@xC9 - BR_COND_PRED Predicted conditional branch executed. 
This event counts when any branch which can be predicted by the 
conditional predictor is retired. This event still counts when branch 
prediction is disabled due to the MMU being off. 
@xCA z BR_INDIRECT_MIS_ PRED Indirect branch mis-predicted. 
This event counts when any indirect branch which can be predicted by 
the BTAC is retired, and has mis-predicted for either the condition or the 
address. This event still counts when branch prediction is disabled due to 
the MMU being off. 
@xCB 7 BR_INDIRECT_ADDR_MIS_PRED | Indirect branch mis-predicted due to address mis-compare. 
This event counts when any indirect branch which can be predicted by 
the BTAC is retired, was taken and correctly predicted the condition, and 
has mis-predicted the address. This event still counts when branch 
prediction is disabled due to the MMU being off. 
@xCC - BR_COND _MIS_PRED 








Conditional branch mis-predicted. 


This event counts when any branch which can be predicted by the 
conditional predictor is retired, and has mis-predicted the condition. This 
event still counts when branch prediction is disabled due to the MMU 
being off. Conditional indirect branches which correctly predicted the 





condition but mis-predicted on the address do not count this event. 
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Table C2-3 PMU events (continued) 





Event 
number 


PMU 
event 
bus 
(to 
trace) 


Event mnemonic 


Event name 





@xCD 


BR_INDIRECT_ADDR_PRED 


Indirect branch with predicted address executed. 


This event counts when any indirect branch which can be predicted by 
the BTAC is retired, was taken and correctly predicted the condition. 
This event still counts when branch prediction is disabled due to the 
MMU being off. 





@xCE 


BR_RETURN_ADDR PRED 


Procedure return with predicted address executed. 


This event counts when any procedure return which can be predicted by 
the CRS is retired, was taken and correctly predicted the condition. This 
event still counts when branch prediction is disabled due to the MMU 
being off. 





OxCF 


BR_RETURN_ADDR_ MIS PRED 


Procedure return mis-predicted due to address mis-compare. 


This event counts when any procedure return which can be predicted by 
the CRS is retired, was taken and correctly predicted the condition, and 
has mis-predicted the address. This event still counts when branch 
prediction is disabled due to the MMU being off. 





@xDO 


L2D_LLWALK_TLB 


Level 2 TLB last-level walk cache access. 


This event does not count if the MMU is disabled. 





@xD1 


L2D_LLWALK_TLB_REFILL 


Level 2 TLB last-level walk cache refill. 


This event does not count if the MMU is disabled. 





@xD2 


L2D_L2WALK_TLB 


Level 2 TLB level-2 walk cache access. 


This event counts accesses to the level-2 walk cache where the last-level 
walk cache has missed. The event only counts when the translation 
regime of the pagewalk uses level 2 descriptors. This event does not 
count if the MMU is disabled. 





@xD3 


L2D_L2WALK_TLB_REFILL 


Level 2 TLB level-2 walk cache refill. 


This event does not count if the MMU is disabled. 





@xD4 


L2D_$2_TLB 


Level 2 TLB IPA cache access. 

This event counts on each access to the IPA cache. 

¢ Ifasingle pagewalk needs to make multiple accesses to the IPA 
cache, each access is counted. 

¢ Ifstage 2 translation is disabled, this event does not count. 








@xD5 





L2D_$2_TLB_REFILL 





Level 2 TLB IPA cache refill. 

This event counts on each refill of the IPA cache. 

¢ Ifasingle pagewalk needs to make multiple accesses to the IPA 
cache, each access which causes a refill is counted. 

¢  Ifstage 2 translation is disabled, this event does not count. 
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Table C2-3 PMU events (continued) 





Event 
number 


PMU 
event 
bus 
(to 
trace) 


Event mnemonic 


Event name 





@xD6 


L2D_CACHE STASH DROPPED 


Level 2 cache stash dropped. 


This event counts on each stash request received from the interconnect or 
ACP, that is targeting L2 and gets dropped due to lack of buffer space to 
hold the request. 





@xE1 


STALL _ FRONTEND CACHE 


No operation issued due to the frontend, cache miss. 


This event counts every cycle the DPU IQ is empty and there is an 
instruction cache miss being processed. 





@xE2 


STALL_ FRONTEND TLB 


No operation issued due to the frontend, TLB miss. 


This event counts every cycle the DPU IQ is empty and there is an 
instruction L1 TLB miss being processed. 





@xE3 


STALL FRONTEND PDERR 


No operation issued due to the frontend, pre-decode error. 


This event counts every cycle the DPU IQ is empty and there is a pre- 
decode error being processed. 





@xE4 


STALL_ BACKEND ILOCK 


No operation issued due to the backend interlock. 


This event counts every cycle that issue is stalled and there is an 
interlock. Stall cycles due to a stall in Wr (typically awaiting load data) 
are excluded. 





@xE5 


STALL_ BACKEND ILOCK AGU 


No operation issued due to the backend, interlock, AGU. 


This event counts every cycle that issue is stalled and there is an 
interlock that is due to a load/store instruction waiting for data to 
calculate the address in the AGU. Stall cycles due to a stall in Wr 
(typically awaiting load data) are excluded. 





@xE6 


STALL _ BACKEND ILOCK FPU 


No operation issued due to the backend, interlock, FPU. 


This event counts every cycle that issue is stalled and there is an 
interlock that is due to an FPU/NEON instruction. Stall cycles due to a 
stall in the Wr stage (typically awaiting load data) are excluded. 





OxE7 


STALL_BACKEND LD 


No operation issued due to the backend, load. 


This event counts every cycle there is a stall in the Wr stage due to a 
load. 





OxE8 


STALL_ BACKEND ST 


No operation issued due to the backend, store. 


This event counts every cycle there is a stall in the Wr stage due to a 
store. 








@xE9 





STALL_BACKEND LD CACHE 





No operation issued due to the backend, load, cache miss. 


This event counts every cycle there is a stall in the Wr stage due to a load 
which is waiting on data (due to missing the cache or being non- 
cacheable). 
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Table C2-3 PMU events (continued) 

















Event PMU _ | Event mnemonic Event name 
number | event 
bus 
(to 
trace) 
OxEA - STALL_BACKEND LD TLB No operation issued due to the backend, load, TLB miss. 
This event counts every cycle there is a stall in the Wr stage due to a load 
which has missed in the L1 TLB. 
@xEB - STALL_BACKEND_ST_STB No operation issued due to the backend, store, STB full. 
This event counts every cycle there is a stall in the Wr stage due to a 
store which is waiting due to the STB being full. 
@xEC - STALL_BACKEND_ ST_TLB No operation issued due to the backend, store, TLB miss. 








This event counts every cycle there is a stall in the Wr stage due to a 
store which has missed in the L1 TLB. 








L2 and L3 cache events (L2D_CACHE*, L3D_CACHE*) 


The behavior of these events depends on the configuration of the core. 


If the private L2 cache is present, the L2D_CACHE* events count the activity in the private L2 cache, 
and the L3D_CACHE% events count the activity in the DSU L3 cache (if present). 


If the private L2 cache is not present but the DSU L3 cache is present, the L2D_CACHE* events count 
activity in the DSU L3 cache and the L3D_CACHE* events do not count. The L2D_ CACHE _WB, 
L2D_CACHE WR and L2D_ CACHE REFILL WR events do not count in this configuration. 


If neither the private L2 cache nor the DSU L3 cache are present, neither the L2D_CACHE* or 


L3D_CACHE* events will count. 


Last Level cache events (LL_CACHE_*) 


The behavior of these events depends on the configuration of the core and the value of the 
CPUECTLR.EXTLLC/CPUECTLR_EL1.EXTLLC bit. 


If the EXTLLC bit is 0: 
These events count activity in the last level of data cache implemented in the core. This is the 
DSU L3 cache if it is present, else the private L2 cache if it is present, otherwise the L1 data 


cache. 


If the EXTLLC bit is 1: 
These events count activity in a last level cache outside the core (if present). These events may 
not count in all implementations. 
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C2.5 PMU interrupts 
The Cortex-A55 core asserts the nPMUIRQ signal when the PMU generates an interrupt. 


You can route this signal to an external interrupt controller for prioritization and masking. This is the 
only mechanism that signals this interrupt to the core. 


This interrupt is also driven as a trigger input to the CTI. See the Arm® DynamIQ™ Shared Unit Technical 
Reference Manual for more information. 
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C2.6 Exporting PMU events 


Some of the PMU events are exported to the ETM trace unit to be monitored. 


Note 


The PMUEVENT bus is not exported to external components. This is because the event bus cannot 
safely cross an asynchronous boundary when events can be generated on every cycle. 
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ETM 


This chapter describes the Embedded Trace Macrocell (ETM) for the Cortex-A55 core. 


It contains the following sections: 

¢« (3.1 About the ETM on page C3-586. 

¢ (3.2 ETM trace unit generation options and resources on page C3-587. 

¢ C3.3 ETM trace unit functional description on page C3-589. 

¢ (3.4 Resetting the ETM on page C3-590. 

* C3.5 Programming and reading ETM trace unit registers on page C3-591. 
* C3.6 ETM trace unit register interfaces on page C3-592. 

* (3.7 Interaction with the PMU and Debug on page C3-593. 





100442 _0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights C3-585 
reserved. 
Non-Confidential 


C3 ETM 
C3.1 About the ETM 


C3.1 About the ETM 


This module performs real-time instruction flow tracing that complies with the ETM architecture, 
ETMv4.2. As a CoreSight component, it is part of the Arm real-time debug solution. 
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C3.2 ETM trace unit generation options and resources 


The following table shows the trace generation options implemented in the Cortex-A55 ETM trace unit. 


Table C3-1 ETM trace unit generation options implemented 


























Description Configuration 
Instruction address size in bytes 8 

Data address size in bytes 0 

Data value size in bytes 0 

Virtual Machine ID size in bytes 4 

Context ID size in bytes 4 

Support for conditional instruction tracing Not implemented 
Support for tracing of data Not implemented 





Support for tracing of load and store instructions as PO elements | Not implemented 












































Support for cycle counting in the instruction trace Implemented 
Support for branch broadcast tracing Implemented 
Number of events supported in the trace 4 

Return stack support Implemented 
Tracing of SError exception support Implemented 
Instruction trace cycle counting minimum threshold l 

Size of Trace ID 7 bits 
Synchronization period support Read-write 
Global timestamp size 64 bits 
Number of cores available for tracing 1 

ATB trigger support Implemented 
Low power behavior override Implemented 
Stall control support Implemented 
Support for overflow avoidance Not implemented 





Support for using CONTEXTIDR_EL2 in VMID comparator | Implemented 














The following table shows the resources implemented in the Cortex-A55 ETM trace unit. 


Table C3-2 ETM trace unit resources implemented 





























Description Configuration 
Number of resource selection pairs implemented 8 
Number of external input selectors implemented 4 
Number of external inputs implemented 47, 4 CTI + 43 PMU 
Number of counters implemented 2 
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C3.2 ETM trace unit generation options and resources 


Table C3-2 ETM trace unit resources implemented (continued) 


















































Description Configuration 
Reduced function counter implemented Not implemented 
Number of sequencer states implemented 4 

Number of Virtual Machine ID comparators implemented | 1 

Number of Context ID comparators implemented 1 

Number of address comparator pairs implemented 4 

Number of single-shot comparator controls 1 

Number of core comparator inputs implemented 0 

Data address comparisons implemented Not implemented 
Number of data value comparators implemented 0 
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C3.3 ETM trace unit functional description 


C3.3 ETM trace unit functional description 
This section describes the functionality of the ETM trace unit. 


The following figure shows the main functional blocks of the ETM trace unit. 





ETM 





CORECLK——=p> 





Trace out <+————-ATB———_> 



















Filtering and triggering 


DebugAre resources 


















Core Core interface 


interface block Trace generation 


























Figure C3-1 ETM functional blocks 


Core interface 
This block monitors the behavior of the core and generates PO elements that are essentially 
executed branches and exceptions traced in program order. 


Trace generation 
The trace generation block generates various trace packets based on PO elements. 


Filtering and triggering resources 
You can limit the amount of trace data generated by the ETM through the process of filtering. 


For example, generating trace only in a certain address range. More complicated logic analyzer 
style filtering options are also available. 


The ETM trace unit can also generate a trigger that is a signal to the trace capture device to stop 
capturing trace. 





FIFO 
The trace generated by the ETM trace unit is in a highly-compressed form. 
The FIFO enables trace bursts to be flattened out. When the FIFO becomes full, the FIFO 
signals an overflow. The trace generation logic does not generate any new trace until the FIFO is 
emptied. This causes a gap in the trace when viewed in the debugger. 

Trace out 
Trace from FIFO is output on the AMBA ATB interface. 
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C3.4 Resetting the ETM 


C3.4 Resetting the ETM 


The reset for the ETM trace unit is the same as a Cold reset for the core. 


The ETM trace unit is not reset when Warm reset is applied to the core so that tracing through Warm core 
reset is possible. 


If the ETM trace unit is reset, tracing stops until the ETM trace unit is reprogrammed and re-enabled. 
However, if the core is reset using Warm reset, the last few instructions provided by the core before the 
reset might not be traced. 
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C3.5 Programming and reading ETM trace unit registers 
You program and read the ETM trace unit registers using the Debug APB interface. 
The core does not have to be in debug state when you program the ETM trace unit registers. 


When you are programming the ETM trace unit registers, you must enable all the changes at the same 
time. Otherwise, if you program the counter, it might start to count based on incorrect events before the 
correct setup is in place for the trigger condition. 


To disable the ETM trace unit, use the TRCPRGCTLR.EN bit. 


( Start ) 


v 
Set main enable bit in 
TRCPRGCTLR to 0b0 








v 





Read TRCSTATR 














No 






Is TRCSTATR Idle 
0b1? 


Yes 


yv 





Program all trace 
registers required 
v 
Set main enable bit in 
TRCPRGCTLR to 0b1 


———EE 
vy 


Read TRCSTATR 

































Is TRCSTATR Idle 
Ob0? 


Yes 


End 


Figure C3-2 Programming ETM trace unit registers 


Related reference 
D8.60 TRCPRGCTLR, Programming Control Register on page D8-776 
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C3.6 ETM trace unit register interfaces 


C3.6 ETM trace unit register interfaces 
The Cortex-A55 core supports only memory-mapped interface to trace registers. 


See the Arm® Embedded Trace Macrocell Architecture Specification ETMyv4 for information on the 
behaviors on register accesses for different trace unit states and the different access mechanisms. 


Related reference 
C1.5 External debug interface on page C1-562 
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C3.7 Interaction with the PMU and Debug 


This section describes the interaction with the PMU and the effect of debug double lock on trace register 
access. 


Interaction with the PMU 


The Cortex-A55 core includes a PMU that enables events, such as cache misses and instructions 
executed, to be counted over a period of time. 


The PMU and ETM trace unit function together. 


Use of PMU events by the ETM trace unit 


The PMU architectural events described in C2.4 PMU events on page C2-567 are available to the ETM 
trace unit through the extended input facility. 


See the Arm® Architecture Reference Manual Armv8, for Armv8s-A architecture profile for more 
information about PMU events. 


The ETM trace unit uses four extended external input selectors to access the PMU events. Each selector 
can independently select one of the PMU events, that are then active for the cycles where the relevant 
events occur. These selected events can then be accessed by any of the event registers within the ETM 
trace unit. The PMU event table describes the PMU events. 


Related reference 
Chapter C2 PMU on page C2-563 
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C3.7 Interaction with the PMU and Debug 
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Debug registers 


Chapter D1 
AArch32 Debug Registers 


This chapter describes the debug registers in the AArch32 Execution state and shows examples of how to 
use them. 


It contains the following sections: 

¢ D1.1 AArch32 debug register summary on page D1-598. 

¢ D1.2 DBGBCR, Debug Breakpoint Control Registers on page D1-601. 
« D1.3 DBGDEVID, Debug Device ID Register on page D1-604. 

¢ DI1.4 DBGDEVID1, Debug Device ID Register 1 on page D1-606. 

¢ DI.5 DBGDIDR, Debug ID Register on page D1-607. 

¢ D1.6 DBGWCR, Debug Watchpoint Control Registers on page D1-609. 
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D1 AArch32 Debug Registers 
D1.1 AArch32 debug register summary 

































































D1.1 AArch32 debug register summary 
The following table summarizes the 32-bit and 64-bit debug control registers that are accessible in the 
AArch32 Execution state from the internal CP 14 interface. These registers are accessed by the MCR and 
MRC instructions in the order of CRn, op2, CRm, Op! or MCRR and MRRC instructions in the order of CRm, 
Opl. 
For those registers not described in this chapter, see the Arm® Architecture Reference Manual Armv8, for 
Armv8s-A architecture profile. See the D3. 1 Memory-mapped debug register summary on page D3-624 
for a complete list of registers accessible from the internal memory-mapped interface or the external 
debug interface. 
Table D1-1 AArch32 debug register summary 
CR |Op2/CR | Op1 | Name Type | Reset Description 
n m 
cO =(|0 c0 10 DBGDIDR RO @x3518Dee0 =| D/.5 DBGDIDR, Debug ID Register on page D1-607 
c0 0 cl 0 DBGDSCRint RO 0x00030000 Debug Status and Control Register, Internal View 
c0 0 c2 0 DBGDCCINT RW _ | 0xeee00000 Debug Comms Channel Interrupt Enable Register 
c0 0 c5 0 DBGDTRTXint WO |- Debug Data Transfer Register, Transmit, Internal View 
c0 0 c5 0 DBGDTRRXint RO 0xee880000 Debug Data Transfer Register, Receive, Internal View 
c0 0 c6 0 DBGWFAR*® RW f- Watchpoint Fault Address Register, RESO 
cO =(|0 c7 ~=«10 DBGVCR RW __ | @xeeeee800 Debug Vector Catch Register 
c0 2 c0 0 DBGDTRRXext RW _ | 0xeeee0e00 Debug Data Transfer Register, Receive, External View 
c0 2 c2 0 DBGDSCRext RW _ | 0x00030000 Debug Status and Control Register, External View 
c0 2 c3 0 DBGDTRTXext RW_ | 0xeee000000 Debug Data Transfer Register, Transmit, External View 
c0 2 c6 0 DBGOSECCR RW_ | 0xeeee0000 Debug OS Lock Exception Catch Control Register 
cO «14 c0 0 DBGBVRO RW __ | XXXXXXXX Debug Breakpoint Value Register 0 
c0 4 cl 0 DBGBVRI1 RW ___ | XXXXXXXX! Debug Breakpoint Value Register 1 
c0 4 c2 0 DBGBVR2 RW | XXXXXXXX* Debug Breakpoint Value Register 2 
cO «|4 c3 0 DBGBVR3 RW | XXXXXXXX* Debug Breakpoint Value Register 3 
cO 14 c4 (10 DBGBVR4 RW __| XXXXXXXxX! Debug Breakpoint Value Register 4 
c0 4 c5 0 DBGBVRS5S RW | XXXXXXXX Debug Breakpoint Value Register 5 
co 5 co 0 DBGBCRO RW | GOXXXXXXS Debug Breakpoint Control Register 0 
See D2.2 DBGBCRn_EL1, Debug Breakpoint Control 
Registers, ELI on page D2-614. 
co | 5 cl |0 DBGBCRI RW | Q@XXXXXXE Debug Breakpoint Control Register | 
See D2.2 DBGBCRn_EL1, Debug Breakpoint Control 
Registers, ELI on page D2-614. 
































Previously returned information about the address of the instruction that accessed a watchpoint address. This register is now deprecated and is RESO. 
The actual reset value is {30{1'bx}},2'bO 
& The actual reset value is 32'b000000000x0x0x0xxx0000xxxxx00xx0. 


mh Oo 
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D1 AArch32 Debug Registers 
D1.1 AArch32 debug register summary 


Table D1-1 AArch32 debug register summary (continued) 








CR |Op2/CR | Op1 | Name Type | Reset Description 
n m 
cO 5 c2 | 0 DBGBCR2 RW | Q@XXXXXXE Debug Breakpoint Control Register 2 


See D2.2 DBGBCRn_EL1, Debug Breakpoint Control 
Registers, ELI on page D2-614. 





cO 5 c3 | 0 DBGBCR3 RW =| GOXXXXXX® Debug Breakpoint Control Register 3 


See D2.2 DBGBCRn_EL1, Debug Breakpoint Control 
Registers, ELI on page D2-614. 





I 
cO 5 c4 | 0 DBGBCR4 RW | GOXXXXXX" Debug Breakpoint Control Register 4 


See D2.2 DBGBCRn_EL1, Debug Breakpoint Control 
Registers, ELI on page D2-614. 





I 
cO 5 cS | 0 DBGBCRS RW =| GOXXXXXX" Debug Breakpoint Control Register 5 


See D2.2 DBGBCRn_EL1, Debug Breakpoint Control 
Registers, ELI on page D2-614. 

















c0 6 c0 0 DBGWVRO RW | XXXXXXXX* Debug Watchpoint Value Register 0 
c0 6 cl 0 DBGWVRI1 RW ___| XXXXXXXX! Debug Watchpoint Value Register 1 
c0 6 c2 0 DBGWVR2 RW | XXXXXXXX* Debug Watchpoint Value Register 2 
c0 6 c3 0 DBGWVR3 RW | XXXXXXXX* Debug Watchpoint Value Register 3 
cO }7 co 0 DBGWCRO RW | XXXXXXXxX' Watchpoint Control Register 0 


See D2.4 DBGWCRn_EL1, Debug Watchpoint Control 
Registers, ELI on page D2-618. 





c0 7 cl 0 DBGWCRI RW | XXXXXXXX! Watchpoint Control Register 1 


See D2.4 DBGWCRn_EL1, Debug Watchpoint Control 
Registers, ELI on page D2-618. 





c0 7 c2 0 DBGWCR2 RW | XXXXXXXX! Watchpoint Control Register 2 


See D2.4 DBGWCRn_EL1, Debug Watchpoint Control 
Registers, ELI on page D2-618. 





c0 a c3 0 DBGWCR3 RW __| XXXXXXXX' Watchpoint Control Register 3 


See D2.4 DBGWCRn_EL1, Debug Watchpoint Control 
Registers, ELI on page D2-618. 




















cl 0 c0 0 DBGDRARJ31:0] | RO - Debug ROM Address Register, RESO 

- - cl - DBGDRAR[63:0] | RO - 

cl 1 c4 «10 DBGBXVR4 RW | XXXXXXXXI Debug Breakpoint Extended Value Register 4 
cl 1 c5 0 DBGBXVR5 RW ___| XXXXXXXxi Debug Breakpoint Extended Value Register 5 
cl 4 c0O 10 DBGOSLAR WO |- Debug OS Lock Access Register 





























h The actual reset value is 32'b00000000xxxx0x0xxx0000xxxxx00xx0. 
The actual reset value is 32'b000xxxxx000x0xOxxxxxXXXXXXXXXXXXO. 
J The actual reset value is 32'hxxxxxxxxx. 
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Table D1-1 AArch32 debug register summary (continued) 









































CR |Op2|CR | Op1 | Name Type | Reset Description 

n m 

cl 4 cl 0 DBGOSLSR RO @x8008800A | Debug OS Lock Status Register 

cl 4 c3. 10 DBGOSDLR RW _ | @xeeeee8e0 Debug OS Double Lock Register 

cl 4 c4 (10 DBGPRCR RW {k Debug Power/Reset Control Register 

c2 2 c0 0 DBGDSARJ[31:0]_ | RO - Debug Self Address Register RESO 

- 0 c2. |- DBGDSAR[63:0]! | RO - 

c7 7 c0 0 DBGDEVID2 RO 0xee880000 Debug Device ID Register 2, RESO 

c7 |7  |el |0 | DBGDEVID1 RO = | 0x@0000080 = | DN] 4 DBGDEVIDI, Debug Device ID Register 1 
on page D1-606 

c7 |7  |e2 }0 | DBGDEVID RO | @x@@110F1@ = | D7. 3 DBGDEVID, Debug Device ID Register 
on page D1-604 

c7 6 c8 0 DBGCLAIMSET |RW __ | 0x@@QQ00FF Debug Claim Tag Set Register 

c7 6 c9 0 DBGCLAIMCLR |RW _ | @xeeee0000 Debug Claim Tag Clear Register 

c7 6 cl4 |0 DBGAUTHSTATU | RO @x@@8Q8GAA™ | Debug Authentication Status Register 

S 





























The actual reset value is 3 1'b60000000000000000000000000000,EDPRCR.COREPURQ. 
Previously defined the offset from the base address defined in DBGDRAR of the physical base address of the debug registers for the core. This register is now 


deprecated and RESO. 
The actual reset value is 24'h000000,1'b1,1'b0,1'b1,1'b0,1'b1,1'b0,1'b1,1'b0. 
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D1.2 DBGBCR, Debug Breakpoint Control Registers 


D1.2 DBGBCR, Debug Breakpoint Control Registers 


The DBGBCRz holds control information for a breakpoint. Each DBGBVR is associated with a 
DBGBCR to form a Breakpoint Register Pair (BRP). DBGBVRz is associated with DBGBCRn to form 
BRPn. The range of n for DBGBCRz is 0 to 5. 


Bit field descriptions 


31 


24 23 20 19 16 15 14 13 12 543210 





= |= | a = Bt 


RESO 


RESO, [31:24] 


RESO 


BT, [23:20] 


Figure D1-1 DBGBCR 


Reserved. 


Breakpoint Type. This field controls the behavior of Breakpoint debug event generation. This 
includes the meaning of the value held in the associated DBGBVRz, indicating whether it is an 
instruction address match or mismatch or a Context match. It also controls whether the 
breakpoint is linked to another breakpoint. The possible values are: 


ebeee0 
@be001 
@be010 
@b0011 
0be100 
@b0101 
0b1000 
@b1001 
0b1010 
@b1011 


U 


nlinked instruction address match. 
inked instruction address match. 
nlinked Context ID match. 

inked Context ID match. 

nlinked instruction address mismatch. 
inked instruction address mismatch. 
nlinked VMID match. 

inked VMID match. 





L 
U 
L 
U 
L 
U 
L 
U 


L 


nlinked VMID + Context ID match. 
inked VMID + Context ID match. 


All other values are reserved. 


The field break down is: 
¢ BTT[3:1]: Base type. If the breakpoint is not context-aware, these bits are REso. Otherwise, the 
possible values are: 


ebeee 
@bee1 
0be10 


0b100 


Match address. DBGBVRz is the address of an instruction. 
Match context ID. DBGBVRn[31:0] is a context ID. 
Address mismatch. Mismatch address. Behaves as type 0b000 if either: 


— In an AArché64 translation regime. 
— Halting debug-mode is enabled and halting is allowed. 


Otherwise, DBGBVRz is the address of an instruction to be stepped. 
Match VMID. DBGBVRn[7:0] is a VMID. 
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D1 AArch32 Debug Registers 
D1.2 DBGBCR, Debug Breakpoint Control Registers 


@b101 Match VMID and context ID. DBGBVRn[31:0] is a context ID, and 
DBGBVRz[7:0] is a VMID. 


¢ BT[O0]: Enable linking. 
LBN, [19:16] 


Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of 
the Context-matching breakpoint linked to. 


SSC, [15:14] 


Security State Control. Determines the security states that a breakpoint debug event for 
breakpoint 7 is generated. 


This field must be interpreted with the Higher Mode Control (HMC), and Privileged Mode 
Control (PMC), fields to determine the mode and security states that can be tested. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
possible values of the fields. 


HMC, [13] 


Hyp Mode Control bit. Determines the debug perspective for deciding when a breakpoint debug 
event for breakpoint n is generated. 


This bit must be interpreted with the SSC and PMC fields to determine the mode and security 
states that can be tested. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
possible values of the fields. 


RESO, [12:9] 
RESO Reserved. 
BAS, [8:5] 


Byte Address Select. Defines which half-words a regular breakpoint matches, regardless of the 
instruction set and execution state. A debugger must program this field as follows: 


ex3 Match the T32 instruction at DBGBVRn. 
@xC Match the T32 instruction at DBGBVRn+2. 
OxF Match the A64 or A32 instruction at DBGBVRz, or context match. 


All other values are reserved. 


The Armv8-A architecture does not support direct execution of Java bytecodes. BAS[3] and 
BAS[1] ignore writes and on reads return the values of BAS[2] and BAS[0] respectively. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for more 
information on how the BAS field is interpreted by hardware. 


RESO, [4:3] 


RESO Reserved. 
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D1.2 DBGBCR, Debug Breakpoint Control Registers 


PMG, [2:1] 


E, [0] 


Privileged Mode Control. Determines the exception level or levels that a breakpoint debug event 
for breakpoint 7 is generated. 


This field must be interpreted with the SSC and HMC fields to determine the mode and security 
states that can be tested. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
possible values of the fields. 


Bits[2:1] have no effect for accesses made in Hyp mode. 


Enable breakpoint. This bit enables the BRP: 

) BRP disabled. 

1 BRP enabled. 

A BRP never generates a breakpoint debug event when it is disabled. 


The value of DBGBCRzn.E is UNKNown on reset. A debugger must ensure that DBGBCRu.E has 
a defined value before it enables debug. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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D1.3 DBGDEVID, Debug Device ID Register 


The DBGDEVID specifies the version of the Debug architecture implemented and some features of the 
debug implementation. 


Bit field descriptions 


28 27 24 23 20 19 1615 12 11 


| L_wPaddrMask 
BPAddrMask 


VectorCatch 


RESO 


Figure D1-2 DBGDEVID bit assignments 
CIDMask, [31:28] 


Specifies the level of support for the Context ID matching breakpoint masking capability. This 
value is: 


exe Context ID masking is not implemented. 
AuxRegs, [27:24] 
Specifies support for the Debug External Auxiliary Control Register. This value is: 


@xe None supported. 


DoubleLock, [23:20] 
Specifies support for the Debug OS Double Lock Register. This value is: 
ex1 The core supports Debug OS Double Lock Register. 


VirtExtns, [19:16] 
Specifies whether EL2 is implemented. This value is: 


ex1 The core implements EL2. 


VectorCatch, [15:12] 
Defines the form of the vector catch event implemented. This value is: 


exe The core implements address matching form of vector catch. 


BPAddrMask, [11:8] 


Indicates the level of support for the Immediate Virtual Address (IVA) matching breakpoint 
masking capability. This value is: 


@xF Breakpoint address masking not implemented. DBGBCRn[28:24] are REso. 


WPAddrMask, [7:4] 


Indicates the level of support for the DVA matching watchpoint masking capability. This value 
is: 


ex1 Watchpoint address mask implemented. 
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[3:0] 
Reserved, RESO. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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D1.4 DBGDEVID1, Debug Device ID Register 1 


The DBGDEVID1 adds to the information given by the DBGDIDR by describing other features of the 
debug implementation. 


Bit field descriptions 


31 0 


po 


RESO 


Figure D1-3 DBGDEVID1 bit assignments 
RESO, [31:0] 


RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 
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D1.5 DBGDIDR, Debug ID Register 


The DBGDIDR specifies the version of the Debug architecture that is implemented and some features of 
the debug implementation. 


Bit field descriptions 


28 27 24 23 20 19 16 15 14 13 12 11 0 


0 DEVID_imp LE 
= at) [a PCSR_imp 


Figure D1-4 DBGDIDR bit assignments 
WRPs, [31:28] 


The number of Watchpoint Register Pairs (WRPs) implemented. The number of implemented 
WRPs is one more than the value of this field. The value is: 


@x3 The core implements 4 WRPs. 


This field has the same value as ID AA64DFRO_EL1.WRPs. 
BRPs, [27:24] 


The number of Breakpoint Register Pairs (BRPs) implemented. The number of implemented 
BRPs is one more than the value of this field. The value is: 


@x5 The core implements 6 BRPs. 
This field has the same value as ID AA64DFRO_EL1.BRPs. 
CTX_CMPs, [23:20] 


The number of BRPs that can be used for Context matching. This is one more than the value of 
this field. The value is: 


ex1 The core implements two Context matching breakpoints, breakpoints 4 and 5. 

This field has the same value as ID AA64DFRO_EL1.CTX_CMPs. 
Version, [19:16] 

The Debug architecture version. 

@x8 The core implements Armv8-A Debug architecture. 
DEVID_imp, [15] 

RAO Reserved. 
nSUHD_imp, [14] 

Secure User Halting Debug not implemented bit. The value is: 

1 The core does not implement Secure User Halting Debug. 
PCSR_imp, [13] 


RAZ Reserved. 


SE, [12] 
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D1.5 DBGDIDR, Debug ID Register 


EL3 implemented. The value is: 


1 The cluster implements EL3. 


RESO, [11:0] 


RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 





100442 0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D1-608 
reserved. 
Non-Confidential 


D1 AArch32 Debug Registers 
D1.6 DBGWCR, Debug Watchpoint Control Registers 


D1.6 DBGWCR, Debug Watchpoint Control Registers 


The DBGWCRz holds control information for a watchpoint. Each DBGWCR is associated with a 
DBGWVR_ELI to form a Watchpoint Register Pair (WRP). DBGWCRaz is associated with 
DBGWVRz_ELI to form WRPn. The range of n for DBGBCRz is 0 to 3. 


Bit field descriptions 


29 28 2423 212019 16 15 14 13 12 543210 
L_wt L_HMC 
RESO 


Figure D1-5 DBGWCR 
RESO, [31:29] 


RESO Reserved. 
MASK, [28:24] 


Address mask. Only objects up to 2GB can be watched using a single mask. 

@beeee No mask. 

@b@001 Reserved. 

@b@010 Reserved. 

Other values mask the corresponding number of address bits, from @b@0011 masking 3 address 


bits (@x@@000007 mask for address) to @b11111 masking 31 address bits (@x7FFFFFFF mask for 
address). 


RESO, [23:21] 


RESO Reserved. 


WT, [20] 
Watchpoint type. Possible values are: 
) Unlinked data address match. 
1 Linked data address match. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
LBN, [19:16] 


Linked breakpoint number. For Linked data address watchpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
SSC, [15:14] 


Security state control. Determines the Security states under which a watchpoint debug event for 
watchpoint n is generated. This field must be interpreted along with the HMC and PAC fields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
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HMC, [13] 


Higher mode control. Determines the debug perspective for deciding when a watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and 
PACfields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
BAS, [12:5] 


Byte address select. Each bit of this field selects whether a byte from within the word or double- 
word addressed by DBGWVRzu is being watched. See the Arm® Architecture Reference Manual 
Armv86, for Armv8-A architecture profile for more information. 


LSC, [4:3] 
Load/store access control. This field enables watchpoint matching on the type of access being 
made. The possible values are: 
@b@1 Match instructions that load from a watchpointed address. 
@b1@ Match instructions that store to a watchpointed address. 
@b11 Match instructions that load from or store to a watchpointed address. 
All other values are reserved, but must behave as if the watchpoint is disabled. Software must 


not rely on this property as the behavior of reserved values might change in a future revision of 
the architecture. 


IGNORED if E is 0. 
On Cold reset, the field reset value is architecturally UNKNOWN. 
PAG, [2:1] 


Privilege of access control. Determines the exception level or levels at which a watchpoint 
debug event for watchpoint n is generated. This field must be interpreted along with the SSC 
and HMCfields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


E, [0] 
Enable watchpoint n. Possible values are: 
() Watchpoint disabled. 
1 Watchpoint enabled. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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Chapter D2 
AArch64 debug registers 


This chapter describes the debug registers in the AArch64 Execution state and shows examples of how to 
use them. 


It contains the following sections: 

¢ D2.1 AArch64 debug register summary on page D2-612. 

¢ D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, ELI on page D2-614. 
¢ D2.3 DBGCLAIMSET ELI, Debug Claim Tag Set Register, ELI on page D2-617. 

¢ D2.4 DBGWCRn_ELI, Debug Watchpoint Control Registers, ELI on page D2-618. 
¢ D2.5 MDSCR_ELI1, Monitor Debug System Control Register, EL1 on page D2-620. 
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D2 AArch64 debug registers 
D2.1 AArch64 debug register summary 




































































D2.1 AArch64 debug register summary 
This section summarizes the debug control registers that are accessible in the AArch64 Execution state. 
These registers, listed in the following table, are accessed by the MRS and MSR instructions in the order of 
Op0, CRn, Op1, CRm, Op?2. 
See D3.1 Memory-mapped debug register summary on page D3-624 for a complete list of registers 
accessible from the external debug interface. The 64-bit registers cover two addresses on the external 
memory interface. For those registers not described in this chapter, see the Arm" Architecture Reference 
Manual Armv8, for Armv8-A architecture profile. 
Table D2-1 AArch64 debug register summary 
Name Type | Reset Width | Description 
OSDTRRX _EL1 RW_ | 0x000000880 | 32 Debug Data Transfer Register, Receive, External View 
DBGBVRO_ EL1 RW |- 64 Debug Breakpoint Value Register 0 
DBGBCRO_EL1 RW | UNK 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 
DBGWVRO EL1 RW |- 64 Debug Watchpoint Value Register 0 
DBGWCRO_EL1 RW |UNK 32 D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 
on page D2-618 
DBGBVRI EL1 RW |- 64 Debug Breakpoint Value Register 1 
DBGBCR1 EL1 RW |UNK 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 
DBGWVRI1 EL1 RW |- 64 Debug Watchpoint Value Register 1 
DBGWCRI1 ELI RW |UNK 32 D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 
on page D2-618 
MDCCINT_EL1 RW_ | 0x000008880 | 32 Monitor Debug Comms Channel Interrupt Enable Register 
MDSCR_EL1 RW |- 32 D2.5 MDSCR_ELI, Monitor Debug System Control Register, EL1 
on page D2-620 
DBGBVR2 _ EL1 RW |- 64 Debug Breakpoint Value Register 2 
DBGBCR2_EL1 RW | UNK 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 
DBGWVR2_ EL1 RW |- 64 Debug Watchpoint Value Register 2 
DBGWCR2 EL1 RW |UNK 32 D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 
on page D2-618 
OSDTRTX_EL1 RW |- 32 Debug Data Transfer Register, Transmit, External View 
DBGBVR3 _ ELI RW |- 64 Debug Breakpoint Value Register 3 
DBGBCR3_EL1 RW |UNK 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 
DBGWVR3_ ELI RW |- 64 Debug Watchpoint Value Register 3 
DBGWCR3_EL1 RW |UNK 32 D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 
on page D2-618 
DBGBVR4 ELI RW |- 64 Debug Breakpoint Value Register 4 
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D2 AArch64 debug registers 
D2.1 AArch64 debug register summary 


Table D2-1 AArch64 debug register summary (continued) 



























































Name Type | Reset Width | Description 

DBGBCR4 EL1 RW |UNK 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 

DBGBVRS5 EL] RW |- 64 Debug Breakpoint Value Register 5 

DBGBCRS _EL1 RW |UNK 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 

OSECCR_EL1 RW_ | 0x000008080 | 32 Debug OS Lock Exception Catch Register 

MDCCSR_ELO RO | 0x000008880 | 32 Monitor Debug Comms Channel Status Register 

DBGDTR_ELO RW _ | 0x00088800 | 64 Debug Data Transfer Register, half-duplex 

DBGDTRTX_ELO WO _ | 0x000000880 | 32 Debug Data Transfer Register, Transmit, Internal View 

DBGDTRRX_ELO RO | 0x000000880 | 32 Debug Data Transfer Register, Receive, Internal View 

DBGVCR32_EL2 RW |- 32 Debug Vector Catch Register 

MDRAR EL1 RO |_ 64 Debug ROM Address Register. This register is reserved, RESO 

OSLAR_EL1 WO |- 32 Debug OS Lock Access Register 

OSLSR_EL1 RO _ | 0@x0@800QOA | 32 Debug OS Lock Status Register 

OSDLR_EL1 RW_ | 0x00@0002080 | 32 Debug OS Double Lock Register 

DBGPRCR_EL1 RW |- 32 Debug Power/Reset Control Register 

DBGCLAIMSET EL1 RW_| Ox@@GOGOFF | 32 D2.3 DBGCLAIMSET_EL1, Debug Claim Tag Set Register, EL1 
on page D2-617 

DBGCLAIMCLR EL1 RW_ | 0x000000880 | 32 Debug Claim Tag Clear Register 

DBGAUTHSTATUS EL1]RO_ | @x0Q@Q@Q@QAA | 32 Debug Authentication Status Register 
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D2 AArch64 debug registers 
D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 


D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 


The DBGBCRn_ELI holds control information for a breakpoint. Each DBGBVR_EL] is associated with 
a DBGBCR_ELI to form a Breakpoint Register Pair (BRP). DBGBVRn_ELI is associated with 
DBGBCRn_ ELI to form BRPn. The range of n for DBGBCRn_EL1 is 0 to 5. 

Bit field descriptions 


The DBGBCRn_ELI registers are 32-bit registers. 


31 24 23 20 19 16.15 14 13 12 5 43210 
RESO 


Figure D2-1 DBGBCRn_EL1 bit assignments 
RESO, [31:24] 


RESO Reserved. 


BT, [23:20] 


Breakpoint Type. This field controls the behavior of Breakpoint debug event generation. This 
includes the meaning of the value held in the associated DBGBVRn_EL1, indicating whether it 
is an instruction address match or mismatch, or a Context match. It also controls whether the 
breakpoint is linked to another breakpoint. The possible values are: 

@beeee Unlinked instruction address match. 

Q@bee0e1 
Qbe010 
@be0011 
Qbe160 
Qb0101 


Linked instruction address match. 
Unlinked Context ID match. 
Linked Context ID match. 
Unlinked instruction address mismatch. 
Linked instruction address mismatch. 
@be118 Unlinked CONTEXTIDR_EL1 match. 
@be111 Linked CONTEXTIDR_EL1 match. 
@b10e0 Unlinked VMID match. 
@b1001 Linked VMID match. 
@b101@ Unlinked VMID + Conext ID match. 
@b1011 Linked VMID + Context ID match. 
@b110@ Unlinked CONTEXTIDR_EL2 match. 
@b1101 Linked CONTEXTIDR_EL2 match. 
@b111@ Unlinked Full Context ID match. 
@b1111 Linked Full Context ID match. 





The field break down is: 

¢ BTT[3:1]: Base type. If the breakpoint is not context-aware, these bits are REso. Otherwise, the 
possible values are: 
@beee Match address. DBGBVRn_ EL] is the address of an instruction. 
@bee1 Match context ID. DBGBVRn_EL1[31:0] is a context ID. 
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D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 


@be1e@ Address mismatch. Mismatch address. Behaves as type 0b000 if either: 
— Inan AArch64 translation regime. 
— Halting debug-mode is enabled and halting is allowed. 


Otherwise, DBGBVRn_EL1 is the address of an instruction to be stepped. 


@be11 Match CONTEXTIDR EL1. DBGBVRn_EL1[31:0] is a context ID. 
@b10e@ Match VMID. DBGBVRza_EL1[47:32] is a VMID. 


@b101 Match VMID and CONTEXTIDR_EL1. DBGBVRn_EL1[31:0] is a context ID, 
and DBGBVRn_EL1[47:32] is a VMID. 


@b118 Match CONTEXTIDR EL2. DBGBVRn_EL1[63:32] is a context ID. 


@b111 Match CONTEXTIDR_EL1 and CONTEXTIDR_EL2. DBGBVRn_EL1[31:0] and 
DBGBVRn_EL1[63:32] are Context IDs. 


¢ BT[O0]: Enable linking. 
LBN, [19:16] 





Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of 
the Context-matching breakpoint linked to. 


SSC, [15:14] 


Security State Control. Determines the Security states under which a Breakpoint debug event for 
breakpoint 7 is generated. 


This field must be interpreted with the Higher Mode Control (HMC), and Privileged Mode 
Control (PMC), fields to determine the mode and security states that can be tested. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
possible values of the HMC and PMC fields. 


HMC, [13] 


Hyp Mode Control bit. Determines the debug perspective for deciding when a breakpoint debug 
event for breakpoint n is generated. 


This bit must be interpreted with the SSC and PMC fields to determine the mode and security 
states that can be tested. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
possible values of the SSC and PMC fields. 


RESO, [12:9] 


RESO Reserved. 


BAS, [8:5] 


Byte Address Select. Defines which half-words a regular breakpoint matches, regardless of the 
instruction set and execution state. A debugger must program this field as follows: 


@x3 Match the T32 instruction at DBGBVRn_EL1. 
@xC Match the T32 instruction at DBGBVRn+2_EL1. 
@xF Match the A64 or A32 instruction at DBGBVRn_ELI, or context match. 


All other values are reserved. 


The Armv8-A architecture does not support direct execution of Java bytecodes. BAS[3] and 
BAS[1] ignore writes and on reads return the values of BAS[2] and BAS[0] respectively. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for more 
information on how the BAS field is interpreted by hardware. 


RESO, [4:3] 
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RESO Reserved. 


PMG, [2:1] 


E, [0] 


Privileged Mode Control. Determines the Exception level or levels that a breakpoint debug 
event for breakpoint n is generated. 


This field must be interpreted with the SSC and HMC fields to determine the mode and security 
states that can be tested. 


See the Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile for 
possible values of the SSC and HMC fields. 


Bits[2:1] have no effect for accesses made in Hyp mode. 


Enable breakpoint. This bit enables the BRP: 

@ BRP disabled. 

1 BRP enabled. 

A BRP never generates a breakpoint debug event when it is disabled. 


The value of DBGBCRn_EL1.E is UNKNown on reset. A debugger must ensure that 
DBGBCRnv_EL1.E has a defined value before it enables debug. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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D2.3 DBGCLAIMSET_EL1, Debug Claim Tag Set Register, EL1 
The DBGCLAIMSET_EL1 is used by software to set CLAIM bits to 1. 


Bit field descriptions 
The DBGCLAIMSET_ ELI is a 32-bit register. 


31 8 7 0 


RESO 


Figure D2-2 DBGCLAIMSET_EL1 bit assignments 
RESO, [31:8] 
RESO Reserved. 
CLAIM, [7:0] 
Claim set bits. 


Writing a | to one of these bits sets the corresponding CLAIM bit to 1. This is an indirect write 
to the CLAIM bits. 


A single write operation can set multiple bits to 1. Writing 0 to one of these bits has no effect. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 
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D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 


The DBGWCRn_ELI holds control information for a watchpoint. Each DBGWCR_ELI is associated 
with a DBGWVR_ELI to form a Watchpoint Register Pair (WRP). DBGWCRn_ EL! is associated with 
DBGWVRn ELI to form WRPn. The range of 1 for DBGBCRn_ EL! is 0 to 3. 

Bit field descriptions 


The DBGWCRn_ELI registers are 32-bit registers. 


29 28 2423 212019 16 15 14 13 12 543210 
L_wt L_HMC 
RESO 


Figure D2-3 DBGWCRn_EL1 bit assignments 
RESO, [31:29] 


RESO Reserved. 


MASK, [28:24] 
Address mask. Only objects up to 2GB can be watched using a single mask. 


eeeee@ No mask. 
90001 Reserved. 
90010 Reserved. 
Other values mask the corresponding number of address bits, from @b@0011 masking 3 address 


bits (@x@@000007 mask for address) to @b11111 masking 31 address bits (@x7FFFFFFF mask for 
address). 


RESO, [23:21] 


RESO Reserved. 


WT, [20] 
Watchpoint type. Possible values are: 
() Unlinked data address match. 
1 Linked data address match. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
LBN, [19:16] 


Linked breakpoint number. For Linked data address watchpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
SSC, [15:14] 


Security state control. Determines the Security states under which a watchpoint debug event for 
watchpoint n is generated. This field must be interpreted along with the HMC and PAC fields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
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HMC, [13] 


Higher mode control. Determines the debug perspective for deciding when a watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and PAC 
fields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
BAS, [12:5] 


Byte address select. Each bit of this field selects whether a byte from within the word or double- 
word addressed by DBGWVRn_ ELI is being watched. See the Arm® Architecture Reference 
Manual Armv8, for Armv8-A architecture profile for more information. 


LSC, [4:3] 


Load/store access control. This field enables watchpoint matching on the type of access being 
made. The possible values are: 


e1 Match instructions that load from a watchpoint address. 
10 Match instructions that store to a watchpoint address. 
11 Match instructions that load from or store to a watchpoint address. 


All other values are reserved, but must behave as if the watchpoint is disabled. Software must 
not rely on this property because the behavior of reserved values might change in a future 
revision of the architecture. 


IGNORED if E is 0. 
On Cold reset, the field reset value is architecturally UNKNOWN. 
PAG, [2:1] 


Privilege of access control. Determines the Exception level or levels at which a watchpoint 
debug event for watchpoint n is generated. This field must be interpreted along with the SSC 
and HMCfields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


E, [0] 
Enable watchpoint n. Possible values are: 
() Watchpoint disabled. 
1 Watchpoint enabled. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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D2.5 MDSCR_EL1, Monitor Debug System Control Register, EL1 


The MDSCR_EL1 main control register for the debug implementation. 


Bit field descriptions 


MDSCR_ ELI is a 32-bit register, and is part of the Debug registers functional group. 


31 30 29 28 27 26 25 24 23 22 21201918 16151413 12 11 765 10 


Rxfull J INTdis — RAz/WwI — _tTpcc LERR Lgss 
TXfull TDA KDE 


RXO HDE 
TXU MDE 
RESO 
Figure D2-4 MDSCR_EL1 bit assignments 
RESO, [31] 


RESO Reserved. 


RXfull, [30] 
Used for save/restore of EDSCR.RXfull 


« When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO, and software must 
treat it as UNK/SBZP. 
« When OSLSR_EL1.OSLK == | (the OS lock is locked), this bit is RW. 


TXfull, [29] 
Used for save/restore of EDSCR.RXfull 
« When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO, and software must 
treat it as UNK/SBZP. 
« When OSLSR_EL1.OSLK == | (the OS lock is locked), this bit is RW. 


RESO, [28] 


RESO Reserved. 


RXO, [27] 
Used for save/restore of EDSCR.RXO. 
« When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 


treat it as UNKNOWN and use an SBZP policy for writes. 
« When OSLSR_EL1.OSLK == | (the OS lock is locked), this bit is RW. 


TXU, [26] 
Used for save/restore of EDSCR.TXU. 


« When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat it as UNKNOWN and use an SBZP policy for writes. 
« When OSLSR_EL1.OSLK == | (the OS lock is locked), this bit is RW. 


RESO, [25:24] 


RESO Reserved. 
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INTdis, [23:22] 
Used for save/restore of EDSCR.INTdis. 
¢« When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 


treat it as UNKNOWN and use an SBZP policy for writes. 
¢ When OSLSR_EL1.OSLK == | (the OS lock is locked), this bit is RW. 


TDA, [21] 
Used for save/restore of EDSCR.TDA. 


« When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat it as UNKNOWN and use an SBZP policy for writes. 
« When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


RESO, [20:19] 
RESO Reserved. 
RAZ/WI, [18:16] 


Reserved, RAZ/WI. Hardware must implement this as RAZ/WI. Software must not rely on this 
property as the behavior of reserved values might change in a future revision of the architecture. 


MDE, [15] 
Monitor debug events. Enable Breakpoint, Watchpoint, and Vector catch debug exceptions. 
0 Breakpoint, Watchpoint, and Vector catch debug exceptions disabled. 
1 Breakpoint, Watchpoint, and Vector catch debug exceptions enabled. 


When this register has an architecturally-defined reset value, this field resets to a value that is 
architecturally UNKNowN on Warm reset. 


HDE, [14] 
Used for save/restore of EDSCR.HDE. 


« When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat it as UNKNOWN and use an SBZP policy for writes. 
¢ When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


KDE, [13] 


Local (kernel) debug enable. If ELp is using AArch64, enable Software debug events within 
ELp. Permitted values are: 


0 Software debug events, other than Software breakpoint instructions, disabled within 
ELp. 
1 Software debug events enabled within ELp. 


RESO if ELp is using AArch32. 


When this register has an architecturally-defined reset value, this field resets to a value that is 
architecturally UNKNowN on Warm reset. 


TDCC, [12] 
Traps ELO accesses to the DCC registers to EL1, from both Execution states: 
0 ELO using AArch64: 


¢ ELO accesses to the MDCCSR_EL0, DBGDTR_EL0, DBGDTRTX_ELO, and 
DBGDTRRX_ELO registers are not trapped to EL1. 


ELO using AArch32: 
¢ ELO accesses to the DBGDSCRint, DBGDTRRXint, DBGDTRTXint, DBGDIDR, 
DBGDSAR, and DBGDRAR registers are not trapped to EL1. 
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1 ELO using AArch64: 


¢ ELO accesses to the MDCCSR_ELO, DBGDTR_EL0, DBGDTRTX_ELO, and 
DBGDTRRX_ELO registers are trapped to EL1. 


ELO using AArch32: 
¢ ELO accesses to the DBGDSCRint, DBGDTRRXint, DBGDTRTXint, DBGDIDR, 
DBGDSAR, and DBGDRAR registers are trapped to EL1. 


All accesses to these AArch32 registers are trapped, including LDC and STC accesses 
to DBGDTRTXint and DBGDTRRXint, and MRRC accesses to DBGDSAR and 
DBGDRAR. 


Traps of AArch32 PLO accesses to the DBGDTRRXint and DBGDTRT Xint are 
IGNORED in Debug state. 


When this register has an architecturally-defined reset value, this field resets to a value 
that is architecturally UNKNowN on Warm reset. 
RESO, [11:7] 
RESO Reserved. 
ERR, [6] 
Used for save/restore of EDSCR.ERR. 
¢ When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 


treat it as UNKNOWN and use an SBZP policy for writes. 
¢ When OSLSR_EL1.OSLK == | (the OS lock is locked), this bit is RW. 


RESO, [5:1] 


RESO Reserved. 


SS, [0] 
Software step control bit. If ELp is using AArch64, enable Software step. Permitted values are: 
0 Software step is disabled. 
1 Software step is unabled. 


RESO if ELp is using AArch32. 


When this register has an architecturally-defined reset value, this field resets to a value that is 
architecturally UNKNowN on Warm reset. 


Configurations 
AArch64 System register MDSCR_EL1 is architecturally mapped to AArch32 System register 
DBGDSCRext. See Arm® Architecture Reference Manual Armvé, for Armv8-A architecture 
profile. 
This register is in the Warm reset domain. Some or all RW fields of this register have defined 
reset values. On a Warm or Cold reset these apply only if the PE resets into an Exception level 


that is using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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Chapter D3 
Memory-mapped debug registers 


This chapter describes the memory-mapped debug registers and shows examples of how to use them. 


It contains the following sections: 


D3.1 Memory-mapped debug register summary on page D3-624. 


D3.2 EDCIDRO, External Debug Component Identification Register 0 on page D3-628. 
D3.3 EDCIDR1, External Debug Component Identification Register 1 on page D3-629. 
D3.4 EDCIDR2, External Debug Component Identification Register 2 on page D3-630. 
D3.5 EDCIDR3, External Debug Component Identification Register 3 on page D3-631. 


D3.6 EDDEVID, External Debug Device ID Register 0 on page D3-632. 

D3.7 EDDEVID1, External Debug Device ID Register 1 on page D3-633. 

D3.8 EDDFR, External Debug Feature Register on page D3-634. 

D3.9 EDITCTRL, External Debug Integration Mode Control Register on page D3-636. 
D3.10 EDPFR, External Debug Processor Feature Register on page D3-637. 


D3.11 EDPIDRO, External Debug Peripheral Identification Register 0 on page D3-639. 
D3.12 EDPIDRI1, External Debug Peripheral Identification Register 1 on page D3-640. 
D3.13 EDPIDR2, External Debug Peripheral Identification Register 2 on page D3-641. 
D3.14 EDPIDR3, External Debug Peripheral Identification Register 3 on page D3-642. 
D3.15 EDPIDR4, External Debug Peripheral Identification Register 4 on page D3-643. 
D3.16 EDPIDRzn, External Debug Peripheral Identification Registers 5-7 on page D3-644. 


D3.17 EDRCR, External Debug Reserve Control Register on page D3-645. 
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D3 Memory-mapped debug registers 
D3.1 Memory-mapped debug register summary 

























































































D3.1 Memory-mapped debug register summary 
The following table shows the offset address for the registers that are accessible from the external debug 
interface. 
For those registers not described in this chapter, see the Arm® Architecture Reference Manual Armv8, for 
Armv8s-A architecture profile. 
Table D3-1 Memory-mapped debug register summary 
Offset Name Type | Width | Description 
@x@00-Ox@1C | - - - Reserved 
0x20 EDESR RW | 32 External Debug Event Status Register 
@x0@24 EDECR RW | 32 External Debug Execution Control Register 
@x028-OxO2C | - - - Reserved 
0x030 EDWAR[31:0] RO | 64 External Debug Watchpoint Address Register 
@x034 EDWAR[63:32] 
@x038-Ox@7C | - - - Reserved 
0x080 DBGDTRRX_ELO RW | 32 Debug Data Transfer Register, Receive 
0x084 EDITR WO | 32 External Debug Instruction Transfer Register 
8x088 EDSCR RW | 32 External Debug Status and Control Register 
@x@8C DBGDTRTX_ELO WO |32 Debug Data Transfer Register, Transmit 
Q@x890 EDRCR WO | 32 D3.17 EDRCR, External Debug Reserve Control Register 
on page D3-645 
@x094 - RW | 32 Reserved 
Qx098 EDECCR RW | 32 External Debug Exception Catch Control Register 
@xe@9C - - - Reserved 
@x0AQ - - - Reserved 
@x0A4 - - - Reserved 
@x@A8 - - - Reserved 
@x@AC - : - Reserved 
@x@BO-Ox2FC | - - - Reserved 
@x300 OSLAR_EL1 WO |32 OS Lock Access Register 
@x304-Ox3@C | - - - Reserved 
0x310 EDPRCR RW | 32 External Debug Power/Reset Control Register 
@x314 EDPRSR RO | 32 External Debug Processor Status Register 
@x318-Ox3FC | - - - Reserved 
0x400 DBGBVRO_EL1[31:0] RW | 64 Debug Breakpoint Value Register 0 
@x404 DBGBVRO_EL1[63:32] 
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D3 Memory-mapped debug registers 
D3.1 Memory-mapped debug register summary 


Table D3-1 Memory-mapped debug register summary (continued) 































































































Offset Name Type | Width | Description 

0x408 DBGBCRO_EL1 RW | 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 

@x40C - - - Reserved 

0x410 DBGBVRI EL1[31:0] RW | 64 Debug Breakpoint Value Register 1 

@x414 DBGBVR1_EL1[63:32] 

0x418 DBGBCR1 EL1 RW | 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 

@x41C - - - Reserved 

@x420 DBGBVR2_ EL1[31:0] RW | 64 Debug Breakpoint Value Register 2 

@x424 DBGBVR2_EL1[63:32] 

@x428 DBGBCR2_EL1 RW | 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 

@x42C - - - Reserved 

0x430 DBGBVR3_EL1[31:0] RW | 64 Debug Breakpoint Value Register 3 

@x434 DBGBVR3_EL1[63:32] 

0x438 DBGBCR3 EL1 RW | 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 

@x43C - - - Reserved 

0x440 DBGBVR4 EL1[31:0] RW | 64 Debug Breakpoint Value Register 4 

@x444 DBGBVR4 _EL1[63:32] 

0x448 DBGBCR4 EL1 RW | 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 

@x44C - - - Reserved 

@x450 DBGBVRS_EL1[31:0] RW | 64 Debug Breakpoint Value Register 5 

@x454 DBGBVRS_EL1[63:32] 

@x458 DBGBCRS EL1 RW | 32 D2.2 DBGBCRn_EL1, Debug Breakpoint Control Registers, EL1 
on page D2-614 

@x45C-Ox7FC | - - - Reserved 

Qx800 DBGWVRO_ EL1[31:0] RW_ | 64 Debug Watchpoint Value Register 0 

@x804 DBGWVRO_EL1[63:32] 

0x88 DBGWCRO_EL1 RW | 32 D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 
on page D2-618 

@x80C - - - Reserved 

0x810 DBGWVRI_ EL1[31:0] RW | 64 Debug Watchpoint Value Register 1 

@x814 DBGWVRI1_EL1[63:32] 

0x818 DBGWCRI1 ELI RW | 32 D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 











on page D2-618 
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D3 Memory-mapped debug registers 
D3.1 Memory-mapped debug register summary 


Table D3-1 Memory-mapped debug register summary (continued) 


































































































Offset Name Type | Width | Description 

@x81C - - - Reserved 

Qx820 DBGWVR2_EL1[31:0] RW | 64 Debug Watchpoint Value Register 2 

@x824 DBGWVR2_EL1[63:32] 

Qx828 DBGWCR2_EL1 RW | 32 D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 
on page D2-618 

@x82C - - - Reserved 

0x830 DBGWVR3_EL1[31:0] RW | 64 Debug Watchpoint Value Register 0, 

@x834 DBGWVR3_EL1[63:32] 

0x838 DBGWCR3 ELI RW | 32 D2.4 DBGWCRn_EL1, Debug Watchpoint Control Registers, EL1 
on page D2-618 

@x83C-OxCFC | - - - Reserved 

@xD0O MIDR RO | 32 B2.89 MIDR_ELI, Main ID Register, EL1 on page B2-433 

@xD@4-@xD1C | - - - Reserved 

@xD20 EDPFR[31:0] RO | 64 B2.63 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 0, EL1 

exD24 EDPFR[63:32] i la 

@xD28 EDDFR{[31:0] RO | 64 B2.63 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 0, EL1 

@xD2C EDDFR[63:32] i a 

@xD60-OxEFC | - - - Reserved 

@xFee - - - Reserved 

@xF@4-OxF9C | - - - Reserved 

OxFA@ DBGCLAIMSET_ EL1 RW | 32 D2.3 DBGCLAIMSET ELI, Debug Claim Tag Set Register, EL1 
on page D2-617 

OxFA4 DBGCLAIMCLR_ ELI RW | 32 Debug Claim Tag Clear Register 

OxFA8 EDDEVAFF0 RO | 32 B1.77 MPIDR, Multiprocessor Affinity Register on page B1-248 

@xFAC EDDEVAFFI1 RO | 32 External Debug Device Affinity Register 1 

@xFB@ - - - Reserved 

@xFB4 - - - Reserved 

OxFB8 DBGAUTHSTATUS_ELI | RO | 32 Debug Authentication Status Register 

@xFBC EDDEVARCH RO | 32 External Debug Device Architecture Register 

@xFCO EDDEVID2 RO |32 External Debug Device ID Register 2, RESO 

@xFC4 EDDEVID1 RO |32 D3.7 EDDEVID1, External Debug Device ID Register 1 
on page D3-633 

@xFC8 EDDEVID RO | 32 D3.6 EDDEVID, External Debug Device ID Register 0 on page D3-632 

@xFCC EDDEVTYPE RO | 32 











External Debug Device Type Register 
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D3 Memory-mapped debug registers 
D3.1 Memory-mapped debug register summary 


Table D3-1 Memory-mapped debug register summary (continued) 





Offset Name Type | Width | Description 





@xFDO EDPIDR4 RO | 32 D3.15 EDPIDR4, External Debug Peripheral Identification Register 4 
on page D3-643 





@xFD4-@xFDC | EDPIDRS5-7 RO | 32 D3.16 EDPIDRn, External Debug Peripheral Identification Registers 
5-7 on page D3-644 





OxFEO EDPIDRO RO | 32 D3.11 EDPIDRO, External Debug Peripheral Identification Register 0 
on page D3-639 





OxFE4 EDPIDR1 RO | 32 D3.12 EDPIDR1, External Debug Peripheral Identification Register 1 
on page D3-640 





OxFE8 EDPIDR2 RO | 32 D3.13 EDPIDR2, External Debug Peripheral Identification Register 2 
on page D3-641 





@xFEC EDPIDR3 RO | 32 D3.14 EDPIDR3, External Debug Peripheral Identification Register 3 
on page D3-642 





OxFFO EDCIDRO RO | 32 D3.2 EDCIDRO, External Debug Component Identification Register 0 
on page D3-628 





OxFF4 EDCIDR1 RO | 32 D3.3 EDCIDRI, External Debug Component Identification Register 1 
on page D3-629 





OxFF8 EDCIDR2 RO |32 D3.4 EDCIDR?2, External Debug Component Identification Register 2 
on page D3-630 








@xFFC EDCIDR3 RO | 32 D3.5 EDCIDR3, External Debug Component Identification Register 3 
on page D3-631 
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D3 Memory-mapped debug registers 
D3.2 EDCIDRO, External Debug Component Identification Register 0 


D3.2 EDCIDRO, External Debug Component Identification Register 0 
The EDCIDRO provides information to identify an external debug component. 


Bit field descriptions 
The EDCIDR0O is a 32-bit register. 


31 8 7 0 


RESO 


Figure D3-1 EDCIDRO bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL_ 0, [7:0] 
@x@D Preamble byte 0. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The EDCIDRO can be accessed through the external debug interface, offset @xFF@. 
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D3 Memory-mapped debug registers 
D3.3 EDCIDR1, External Debug Component Identification Register 1 


D3.3 EDCIDR1, External Debug Component Identification Register 1 


The EDCIDR1 provides information to identify an external debug component. 


Bit field descriptions 
The EDCIDR1 is a 32-bit register. 


31 8 7 4 3 0 
RESO 


Figure D3-2 EDCIDR1 bit assignments 
RESO, [31:8] 
RESO Reserved. 
CLASS, [7:4] 
@x9 Debug component. 
PRMBL._1, [3:0] 
@xe Preamble. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The EDCIDRI can be accessed through the external debug interface, offset @xFF4. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D3-629 
reserved. 
Non-Confidential 


D3 Memory-mapped debug registers 
D3.4 EDCIDR2, External Debug Component Identification Register 2 


D3.4 EDCIDR2, External Debug Component Identification Register 2 
The EDCIDR2 provides information to identify an external debug component. 


Bit field descriptions 
The EDCIDR2 is a 32-bit register. 


31 8 7 0 


RESO 


Figure D3-3 EDCIDR2 bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL 2, [7:0] 
@x@5 = Preamble byte 2. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The EDCIDR2 can be accessed through the external debug interface, offset @xFF8. 
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D3 Memory-mapped debug registers 
D3.5 EDCIDR3, External Debug Component Identification Register 3 


D3.5 EDCIDR3, External Debug Component Identification Register 3 
The EDCIDR3 provides information to identify an external debug component. 


Bit field descriptions 
The EDCIDR3 is a 32-bit register. 


31 8 7 0 


RESO 


Figure D3-4 EDCIDR3 bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL_ 3, [7:0] 
@xB1 Preamble byte 3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The EDCIDR3 can be accessed through the external debug interface, offset @xFFC. 
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D3 Memory-mapped debug registers 
D3.6 EDDEVID, External Debug Device ID Register 0 


D3.6 EDDEVID, External Debug Device ID Register 0 


The EDDEVID provides extra information for external debuggers about features of the debug 
implementation. 


Bit field descriptions 
The EDDEVID is a 32-bit register. 


31 28 27 24 23 0 
Pomp 
RESO 


Figure D3-5 EDDEVID bit assignments 
RESO, [31:28] 
RESO Reserved. 
AuxRegs, [27:24] 
Indicates support for Auxiliary registers: 
@xe None supported. 
RESO, [23:0] 


RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The EDDEVID can be accessed through the external debug interface, offset @xFCs8. 
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D3 Memory-mapped debug registers 
D3.7 EDDEVID1, External Debug Device ID Register 1 


D3.7 EDDEVID1, External Debug Device ID Register 1 


The EDDEVID1 provides extra information for external debuggers about features of the debug 
implementation. 


Bit field descriptions 
The EDDEVID1 is a 32-bit register. 


31 0 


SSS EE ES SS 


RESO 


Figure D3-6 EDDEVID1 bit assignments 
RESO, [31:0] 


RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé8, for Armv8-A architecture profile. 


The EDDEVID1 can be accessed through the external debug interface, offset @xFC4. 
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63 


D3 Memory-mapped debug registers 
D3.8 EDDFR, External Debug Feature Register 


EDDFR, External Debug Feature Register 


The EDDFR provides top level information about the debug system in AArch64. 


Bit field descriptions 
The EDDFR is a 64-bit register. 


32 31 28 27 24 23 20 19 1615 12 11 





45 


Figure D3-7 EDDFR bit assignments 





RESO, [63:32] 


RESO Reserved. 


CTX_CMPs, [31:28] 


Number of breakpoints that are context-aware, minus |. These are the highest numbered 
breakpoints. 


RESO, [27:24] 


RESO Reserved. 


WRPs, [23:20] 
Number of watchpoints, minus |. The value of @b@0@@ is reserved. 
RESO, [19:16] 


RESO Reserved. 


BRPs, [15:12] 


Number of breakpoints, minus 1. The value of @b8@@ is reserved. 


PMUVer, [11:8] 


Performance Monitors extension version. Indicates whether system register interface to 
Performance Monitors extension is implemented. Defined values are: 


@x0080 Performance Monitors extension system registers not implemented. 
@x0001 Performance Monitors extension system registers implemented, PMUv3. 


@x11111 IMPLEMENTATION DEFINED form of performance monitors supported, PMUv3 not 
supported. 


All other values are reserved. 


TraceVer [7:4] 


Trace support. Indicates whether system register interface to a trace macrocell is implemented. 
Defined values are: 


@x0000 Trace macrocell system registers not implemented. 


@x0001 Trace macrocell system registers implemented. 


All other values are reserved. 
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D3 Memory-mapped debug registers 
D3.8 EDDFR, External Debug Feature Register 


A value of @x@@0@ only indicates that no system register interface to a trace macrocell is 
implemented. A trace macrocell might nevertheless be implemented without a system register 
interface. 


UNKOWN, [3:0] 


UNKNOWN Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


EDDFR{[31:0] can be accessed through the external debug interface, offset @xD28. 


EDDFR[63:32] can be accessed through the external debug interface, offset @xD2C. 
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D3 Memory-mapped debug registers 
D3.9 EDITCTRL, External Debug Integration Mode Control Register 


D3.9 EDITCTRL, External Debug Integration Mode Control Register 


The EDITCTRL enables the external debug to switch from its default mode into integration mode, where 
test software can control directly the inputs and outputs of the core, for integration testing or topology 
detection. 


Bit field descriptions 
The ESITCTRL is a 32-bit register. 


31 10 
ime — 
RESO 


Figure D3-8 EDITCTRL bit assignments 
[31:1] 
RESO Reserved. 
IME, [0] 
Integration Mode Enable. 


RESO. The device does not revert to an integration mode to enable integration testing or 
topology detection. 
Bit fields and details not provided in this description are architecturally defined. See the Arm® 


Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The EDITCTRL can be accessed through the external debug interface, offset @xFee. 
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D3 Memory-mapped debug registers 
D3.10 EDPFR, External Debug Processor Feature Register 


D3.10 EDPFR, External Debug Processor Feature Register 


The EDPFR provides additional information about implemented PE features in AArch64. 


Bit field descriptions 
The EDPFR is a 64-bit register. 





63 28 27 », 24 23 2019, 1615), 1211), 8 7» 43>» 0 
2 [ele [e| 
RESO 


Figure D3-9 EDPFR bit assignments 
RESO, [63:28] 
RESO Reserved. 
GIC, [27:24] 
System register GIC interface. Defined values are: 


exe No System register interface to the GIC is supported. 
ex1 System register interface to the GIC CPU interface is supported. 


All other values are reserved. 
AdvSIMD, [23:20] 
Advanced SIMD. Defined values are: 
exe Advanced SIMD is implemented. 
@xF Advanced SIMD is not implemented. 


All other values are reserved. 


FP, [19:16] 
Floating-point. Defined values are: 
exe Floating-point is implemented. 
@xF Floating-point is not implemented. 


All other values are reserved. 
EL3 handling, [15:12] 
EL3 exception handling: 


@x2 Instructions can be executed at EL3 in AArch64 or AArch32 state. 


EL2 handling, [11:8] 
EL2 exception handling: 


@x2 Instructions can be executed at EL2 in AArch64 or AArch32 state. 


EL1 handling, [7:4] 


ELI exception handling. The possible values are: 
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D3 Memory-mapped debug registers 
D3.10 EDPFR, External Debug Processor Feature Register 


@x2 Instructions can be executed at EL1 in AArch64 or AArch32 state. 


ELO handling, [3:0] 
ELO exception handling. The possible values are: 
@x2 Instructions can be executed at ELO in AArch64 or AArch32 state. 
Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
The EDPFR[31:0] can be accessed through the external debug interface, offset @xD20. 
The EDPFR[63:32] can be accessed through the external debug interface, offset @xD24. 
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D3 Memory-mapped debug registers 
D3.11 EDPIDRO, External Debug Peripheral Identification Register 0 


D3.11 EDPIDRO, External Debug Peripheral Identification Register 0 
The EDPIDRO provides information to identify an external debug component. 


Bit field descriptions 
The EDPIDRO is a 32-bit register. 


31 8 7 0 


a 


RESO 


Figure D3-10 EDPIDRO bit assignments 
RESO, [31:8] 
RESO Reserved. 
Part_0, [7:0] 
@xe5 Least significant byte of the debug part number. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The EDPIDRO can be accessed through the external debug interface, offset @xFE@. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D3-639 
reserved. 
Non-Confidential 


D3 Memory-mapped debug registers 
D3.12 EDPIDR1, External Debug Peripheral Identification Register 1 


D3.12 EDPIDR1, External Debug Peripheral Identification Register 1 
The EDPIDRI provides information to identify an external debug component. 


Bit field descriptions 
The EDPIDR1 is a 32-bit register. 


31 8 7 4 3 0 


RESO 


Figure D3-11 EDPIDR1 bit assignments 
RESO, [31:8] 
RESO Reserved. 
DES_0, [7:4] 
@xB Arm Limited. This is the least significant nibble of JEP106 ID code. 
Part_1, [3:0] 
@xD Most significant nibble of the debug part number. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The EDPIDRI can be accessed through the external debug interface, offset @xFE4. 
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D3 Memory-mapped debug registers 
D3.13 EDPIDR2, External Debug Peripheral Identification Register 2 


D3.13  EDPIDR2, External Debug Peripheral Identification Register 2 


The EDPIDR2 provides information to identify an external debug component. 


Bit field descriptions 
The EDPIDR2 is a 32-bit register. 


31 8 7 432 0 
JEDEC —! 
RESO 


Figure D3-12 EDPIDR2 bit assignments 

RESO, [31:8] 

RESO Reserved. 
Revision, [7:4] 

2 12p0. 
JEDEC, [3] 

@b1 RAO. Indicates a JEP 106 identity code is used. 
DES 1, [2:0] 

@be11 Arm Limited. This is the most significant nibble of JEP106 ID code. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The EDPIDR2 can be accessed through the external debug interface, offset @xFE8. 
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D3 Memory-mapped debug registers 
D3.14 EDPIDR3, External Debug Peripheral Identification Register 3 


D3.14 EDPIDR3, External Debug Peripheral Identification Register 3 


The EDPIDR3 provides information to identify an external debug component. 


Bit field descriptions 
The EDPIDR3 is a 32-bit register. 


31 8 7 4 3 0 
RESO 


Figure D3-13 EDPIDR3 bit assignments 
RESO, [31:8] 


RESO Reserved. 


REVAND, [7:4] 


@xe Part minor revision. 
CMOD, [3:0] 
@xe Customer modified. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The EDPIDR3 can be accessed through the external debug interface, offset @xFEC. 
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D3 Memory-mapped debug registers 
D3.15 EDPIDR4, External Debug Peripheral Identification Register 4 


D3.15 EDPIDR4, External Debug Peripheral Identification Register 4 
The EDPIDR4 provides information to identify an external debug component. 


Bit field descriptions 
The EDPIDR4 is a 32-bit register. 


31 8 7 4 3 0 


RESO 


Figure D3-14 EDPIDR4 bit assignments 
RESO, [31:8] 
RESO Reserved. 
SIZE, [7:4] 


exe Size of the component. Log, the number of 4KB pages from the start of the 
component to the end of the component ID registers. 


DES 2, [3:0] 
@x4 Arm Limited This is the least significant nibble JEP106 continuation code. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The EDPIDR4 can be accessed through the external debug interface, offset @xFD@. 
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D3 Memory-mapped debug registers 
D3.16 EDPIDRn, External Debug Peripheral Identification Registers 5-7 


D3.16 EDPIDRn, External Debug Peripheral Identification Registers 5-7 
No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 
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D3 Memory-mapped debug registers 
D3.17 EDRCR, External Debug Reserve Control Register 


D3.17 EDRCR, External Debug Reserve Control Register 


The EDRCR is part of the Debug registers functional group. This register is used to allow imprecise 
entry to Debug state and clear sticky bits in EDSCR. 


Bit field descriptions 
The EDRCR is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918 17161514131211109 8 76543210 


CBRRQ—! 
RESO CSPA 
CSE 


Figure D3-15 EDRCR bit assignments 





RESO, [31:5] 


RESO Reserved. 


CBRRQ, [4] 
Allow imprecise entry to Debug state. The actions on writing to this bit are: 
() No action. 
1 Allow imprecise entry to Debug state, for example by canceling pending bus accesses. 


Setting this bit to 1 allows a debugger to request imprecise entry to Debug state. An 
External Debug Request debug event must be pending before the debugger sets this bit 
to 1. 


CSPA, [3] 


Clear Sticky Pipeline Advance. This bit is used to clear the EDSCR.PipeAdv bit to 0. The 
actions on writing to this bit are: 


(4) No action. 
1 Clear the EDSCR.PipeAdv bit to 0. 
CSE, [2] 


Clear Sticky Error. Used to clear the EDSCR cumulative error bits to 0. The actions on writing 
to this bit are: 


(4) No action 


1 Clear the EDSCR. {TXU, RXO, ERR} bits, and, if the core is in Debug state, the 
EDSCR.ITO bit, to 0. 


RESO, [1:0] 
RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The EDRCR can be accessed through the external debug interface, offset 0xe92. 
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D3 Memory-mapped debug registers 
D3.17 EDRCR, External Debug Reserve Control Register 
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Chapter D4 
AArch32 PMU Registers 


This chapter describes the AArch32 PMU registers and shows examples of how to use them. 


It contains the following sections: 

¢ D4.1 AArch32 PMU register summary on page D4-648. 

¢ D4.2 PMCEIDO, Performance Monitors Common Event Identification Register 0 on page D4-650. 
¢ D4.3 PMCEID1, Performance Monitors Common Event Identification Register I on page D4-654. 
¢« D4.4 PMCR, Performance Monitors Control Register on page D4-657. 
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D4 AArch32 PMU Registers 
D4.1 AArch32 PMU register summary 



























































D4.1 AArch32 PMU register summary 
The PMU counters and their associated control registers are accessible in the AArch32 Execution state 
from the internal CP15 system register interface with MCR and MRC instructions for 32-bit registers and 
MCRR and MRRC for 64-bit registers. 
The following table gives a summary of the Cortex-A55 PMU registers in the AArch32 Execution state. 
For those registers not described in this chapter, see the Arm® Architecture Reference Manual Armv8, for 
Armv8-A architecture profile. 
Table D4-1 PMU register summary in the AArch32 Execution state 
CRn | Op1 | CRm | Op2 | Name Type | Width | Reset Description 
c9 0 cl2 |0 PMCR RW | 32 @x41453000 D4.4 PMCR, Performance Monitors 
Control Register on page D4-657 
co 0 cl2 | 1 PMCNTENSET |RW_ | 32 UNK Performance Monitors Count Enable Set 
Register 
co 0 cl2 2 PMCNTENCLR |RW_ | 32 UNK Performance Monitors Count Enable 
Clear Register 
co =«0 cl2 |3 PMOVSR RW | 32 UNK Performance Monitors Overflow Flag 
Status Register 
co 0 cl2 |4 PMSWINC WO | 32 UNK Performance Monitors Software 
Increment Register 
co 0 el2 |5 PMSELR RW | 32 UNK Performance Monitors Event Counter 
Selection Register 
co |0 |cl2 |6  |PMCEIDO BO 132° | irra dp pseu D4.2 PMCEIDO, Performance Monitors 
©x67FFBFEF. If L3 is Common Event Identification Register 0 
present: @x66FFBBFFF. If | °" page D4-650 
L2 and L3 are not present: 
Ox663FBFFF. 
c9 0 cl2 |7 PMCEID1 RO | 32 IfL2 and L3 are present: | 24.3 PMCEIDI, Performance Monitors 
@x@QF2AE7F. If L2 or L3_ | Common Event Identification Register 1 
is present: @x@@F2AQ7F. | ON page D4-654 
If L2 and L3 are not 
present: OxOOF 2A@7E. 
co |0 Jcl4 |4  |PMCEID2 RO /32. |unK Reserved 
co |0 |el4 |5 | PMCEID3 RO /32. JUNK Recent 
c9 0 cl3 |0 PMCCNTR[31:0])RW_ | 32 UNK Performance Monitors Cycle Count 
coo «3 cl3 | 0 PMCCNTR[63:0] |RW | 64 UNK Register 
c9 0 cl3 | 1 PMXEVTYPER |RW_ | 32 UNK Performance Monitors Selected Event 
Type Register 
c9 0 cl3 |2 PMXEVCNTR |RW_ /|32 UNK Performance Monitors Selected Event 









































Count Register 
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D4 AArch32 PMU Registers 
D4.1 AArch32 PMU register summary 


Table D4-1 PMU register summary in the AArch32 Execution state (continued) 




















































































































CRn | Op1 | CRm | Op2 | Name Type | Width | Reset Description 

co 0 cl4 0 PMUSERENR RW | 32 UNK Performance Monitors User Enable 
Register 

co 0 cl4 | 1 PMINTENSET | RW | 32 UNK Performance Monitors Interrupt Enable 
Set Register 

co 0 cl4 2 PMINTENCLR | RW_ | 32 UNK Performance Monitors Interrupt Enable 
Clear Register 

co «0 cl4 }3 PMOVSSET RW | 32 UNK Performance Monitor Overflow Flag 
Status Set Register 

cl4 |0 c8 0 PMEVCNTRO RW | 32 UNK Performance Monitor Event Count 

cl4 |O0 |c8 {1  |PMEVCNTRI |RW |32 UNK Registers 

cl4 |0 c8 2 PMEVCNTR2 RW | 32 UNK 

cl4 |0 c8 3 PMEVCNTR3 RW | 32 UNK 

cl4 |0 c8 4 PMEVCNTR4 RW | 32 UNK 

cl4 |0 c8 5 PMEVCNTRS5 RW | 32 UNK 

cl4 |0 cl2 /0 PMEVTYPERO |RW_ | 32 UNK Performance Monitors Event Type 

cl4 |O0  |cl2 |1  |PMEVTYPERI |RW |32 UNK Registers 

cl4 |0 cl2 |2 PMEVTYPER2 |RW _ /|32 UNK 

cl4 |0 cl2 |3 PMEVTYPER3 |RW _ /|32 UNK 

cl4 |0 cl2 |4 PMEVTYPER4 |RW _ /|32 UNK 

cl4 |0 cl2 |5 PMEVTYPERS |RW _ /|32 UNK 

cl4 |0 clS )7 PMCCFILTR RW | 32 UNK Performance Monitors Cycle Count Filter 
Register 

100442_0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D4-649 
reserved. 


Non-Confidential 


D4 AArch32 PMU Registers 


D4.2 PMCEIDO, Performance Monitors Common Event Identification Register 0 















































D4.2 PMCEIDO, Performance Monitors Common Event Identification Register 0 
The PMCEID0 defines which common architectural and common microarchitectural feature events are 
implemented. 

Bit field descriptions 
31 30 29 28 27 26 25 24 23 22 21 201918 17161514131211109 8 76543 21 0 
ID[31:0] 
Figure D4-1 PMCEIDO bit assignments 
ID[31:0], [31:0] 
Common architectural and microarchitectural feature events that can be counted by the PMU 
event counters. 
The following table shows the PMCEID0 bit assignments with event implemented or not 
implemented when the associated bit is set to 1 or 0. See the Arm® Architecture Reference 
Manual Armv8s, for Armv8-A architecture profile for more information about these events. 
Table D4-2 PMU events 
Bit | Event number | Event mnemonic Description 
(31] | Ox1F L1D_CACHE ALLOCATE L1 Data cache allocate: 
2) This event is not implemented. 

[30] | @x1E CHAIN Chain. For odd-numbered counters, counts once for each overflow of the 
preceding even-numbered counter. For even-numbered counters, does not 
count: 

1 This event is implemented. 

[29] | @x1D BUS_CYCLES Bus cycle: 

1 This event is implemented. 

[28] | @x1c TTBR_WRITE_RETIRED TTBR write, architecturally executed, condition check pass - write to 
translation table base: 

1 This event is implemented. 

[27] | @x1B INST_SPEC Instruction speculatively executed: 
1 This event is implemented. 

[26] | @x1A MEMORY_ERROR Lesa misihoty ction 
1 This event is implemented. 

[25] | @x19 BUS_ACCESS Bisancese: 

1 This event is implemented. 
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D4 AArch32 PMU Registers 


D4.2 PMCEIDO, Performance Monitors Common Event Identification Register 0 


Table D4-2 PMU events (continued) 






































Bit | Event number | Event mnemonic Description 
[24] | 0x18 L2D_CACHE_WB L2 Data cache Write-Back: 

2) This event is not implemented if the Cortex-A55 core has been 
configured without an L2 cache. 

1 This event is implemented if the Cortex-A55 core has been 
configured with an L2 cache. 

[23] | @x17 L2D_CACHE_REFILL L2 Data cache refill: 

2) This event is not implemented if the Cortex-A55 core has been 
configured without an L2 and L3 cache. If configured with only 
an L3 cache, the L3 event will become an L2 event. 

1 This event is implemented if the Cortex-A55 core has been 
configured with an L2 or L3 cache. 

[22] | 0x16 L2D_CACHE L2 Data cache access: 

) This event is not implemented if the Cortex-A55 core has been 
configured without an L2 and L3 cache. If configured with only 
an L3 cache, the L3 event will become an L2 event. 

1 This event is implemented if the Cortex-A55 core has been 
configured with an L2 or L3 cache. 

[21] | @x15 LID_CACHE_WB L1 Data cache Write-Back: 

1 This event is implemented. 
[20] | @x14 LII_ CACHE L1 Instruction cache access: 

1 This event is implemented. 
[19] | @x13 MEM_ACCESS Data memory access: 

1 This event is implemented. 

[18] | @x12 BR_PRED Predictable branch speculatively executed: 

1 This event is implemented. 

[17] | @x11 CPU_CYCLES Cycle: 

1 This event is implemented. 

[16] | @x19@ BR_MIS_PRED Mispredicted or not predicted branch speculatively executed: 

1 This event is implemented. 

[15] | @x@F UNALIGNED_LDST_RETIRED 








1 





Instruction architecturally executed, condition check pass - unaligned load 
or store: 


This event is implemented. 
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D4 AArch32 PMU Registers 


D4.2 PMCEIDO, Performance Monitors Common Event Identification Register 0 


Table D4-2 PMU events (continued) 





















































Bit | Event number | Event mnemonic Description 
[14] | @x@E BR_RETURN_RETIRED Instruction architecturally executed, condition check pass - procedure 
return: 
1 This event is implemented. 
[13] | @x@D BR_IMMED_RETIRED Instruction architecturally executed - immediate branch: 
1 This event is implemented. 
[12] | @xec PC_WRITE_ RETIRED Instruction architecturally executed, condition check pass - software 
change of the PC: 
1 This event is implemented. 
[11] | @x@B CID_WRITE_RETIRED Instruction architecturally executed, condition check pass - write to 
CONTEXTIDR: 
1 This event is implemented. 
[10] | @x@A EXC_RETURN Instruction architecturally executed, condition check pass - exception 
return: 
1 This event is implemented. 
[9] | @x@9 EXC_TAKEN Exception taken: 
1 This event is implemented. 
[8] | 0x08 INST_RETIRED Instruction architecturally executed: 
1 This event is implemented. 
[7] | @x@7 ST_RETIRED Instruction architecturally executed, condition check pass - store: 
1 This event is implemented. 
[6] | @x@6 LD_RETIRED Instruction architecturally executed, condition check pass - load: 
1 This event is implemented. 
[5] | @x@5 LID_TLB_REFILL LI Data TLB refill: 
1 This event is implemented. 
[4] | @xe4 LID_CACHE L1 Data cache access: 
1 This event is implemented. 
[3] | @xe3 L1D_CACHE _ REFILL L1 Data cache refill: 
1 This event is implemented. 
[2] | @xe2 L1I_TLB_REFILL L1 Instruction TLB refill: 





1 This event is implemented. 
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D4 AArch32 PMU Registers 
D4.2 PMCEIDO, Performance Monitors Common Event Identification Register 0 


Table D4-2 PMU events (continued) 














Bit | Event number | Event mnemonic Description 
[1] | @x@1 L1I_CACHE_REFILL L1 Instruction cache refill: 
1 This event is implemented. 
[0] | @xee SW_INCR Instruction architecturally executed, condition check pass - software 








increment: 


1 This event is implemented. 











Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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D4 AArch32 PMU Registers 
D4.3 PMCEID1, Performance Monitors Common Event Identification Register 1 
































D4.3 PMCEID1, Performance Monitors Common Event Identification Register 1 
The PMCEID1 defines which common architectural and common microarchitectural feature events are 
implemented. 

Bit field descriptions 
31 30 29 28 27 26 25 24 23 22 21 201918 17161514131211109 8 76543 21 0 
ID[63:32] 
Figure D4-2 PMCEID1 bit assignments 
ID[63:32], [31:0] 
Common architectural and microarchitectural feature events that can be counted by the PMU 
event counters. 
For each bit described in the following table, the event is implemented if the bit is set to 1, or 
not implemented if the bit is set to 0. 
Table D4-3 PMU common events 
Bit | Event number | Event mnemonic Description 
[24] | 0x38 REMOTE ACCESS RD Access to another socket in a multi-socket system. 
1 This event is implemented. 
[23] | @x37 LL_CACHE_MISS_RD Last Level cache miss, read. 
1 This event is implemented. 
[22] | 0x36 LL_CACHE_RD Last Level cache access, read. 
1 This event is implemented. 
[21] | @x35 ITLB_WALK Access to instruction TLB that caused a page table walk. 
1 This event is implemented. 
[20] | 0x34 DTLB_WALK Access to data TLB that caused a page table walk. 
1 This event is implemented. 
[16] | 0x30 L2I_TLB Attributable Level 2 instruction TLB access. 
7) This event is not implemented. 
[15] | @x2F L2D_TLB Attributable Level 2 data or unified TLB access. 
1 This event is implemented. 
[14] | @x2E L21_ TLB_REFILL Attributable Level 2 instruction TLB refill. 
i) This event is not implemented. 
[13] ) @x2D L2D_TLB_REFILL Attributable Level 2 data or unified TLB refill. 
1 This event is implemented. 
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D4 AArch32 PMU Registers 
D4.3 PMCEID1, Performance Monitors Common Event Identification Register 1 


Table D4-3 PMU common events (continued) 






























































Bit | Event number | Event mnemonic Description 
[12] | @x2c L3D_CACHE_WB Attributable Level 3 data or unified cache write-back. 
7) This event is not implemented. 
[11] | @x2B L3D_CACHE Attributable Level 3 data or unified cache access. 
1 This event is implemented if L2 and L3 are present. 
@ This event is not implemented if L2 and L3 are not present. 
[10] | @x2A L3D_CACHE_REFILL Attributable Level 3 data or unified cache refill. 
1 This event is implemented if L2 and L3 are present. 
@ This event is not implemented if L2 and L3 are not present. 
[9] | @x29 L3D_CACHE_ ALLOCATE | Attributable Level 3 data or unified cache allocation without refill. 
1 This event is implemented if L2 and L3 are present. 
@ This event is not implemented if L2 and L3 are not present. 
[8] | 0x28 L21_CACHE_REFILL Attributable Level 2 instruction cache refill. 
2) This event is not implemented. 
[7] | @x27 L21_CACHE Attributable Level 2 instruction cache access. 
7) This event is not implemented. 
[6] | @x26 L1I_TLB Level | instruction TLB access. 
1 This event is implemented. 
[5] | @x25 L1D_TLB Level | data or unified TLB access. 
1 This event is implemented. 
[4] | @x24 STALL_BACKEND No operation issued due to backend. 
1 This event is implemented. 
[3] | @x23 STALL_FRONTEND No operation issued due to the frontend. 
1 This event is implemented. 
[2] | x22 BR_MIS_ PRED RETIRED | Instruction architecturally executed, mispredicted branch. 
1 This event is implemented. 
[1] | @x21 BR_RETIRED Instruction architecturally executed, branch. 
1 This event is implemented. 
[0] | @x2@ L2D_CACHE_ALLOCATE | Level 2 data cache allocation without refill. 
1 This event is implemented. 
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D4 AArch32 PMU Registers 
D4.3 PMCEID1, Performance Monitors Common Event Identification Register 1 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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D4 AArch32 PMU Registers 
D4.4 PMCR, Performance Monitors Control Register 


D4.4 PMCR, Performance Monitors Control Register 


The PMCR provides details of the Performance Monitors implementation, including the number of 
counters implemented, and configures and controls the counters. 


Bit field descriptions 


PMCR is a 32-bit register, and is part of the Performance Monitors registers functional group. 


24 23 1615 11 10 76543 2 1 0 





L pp 
LC 


RESO 


Figure D4-3 PMCR bit assignments 
IMP, [31:24] 
Indicates the implementer code. The value is: 


@x41 ASCII character 'A' - implementer is Arm Limited. 


IDCODE, [23:16] 
Identification code. The value is: 
@x45 Cortex-A55 core. 
N, [15:11] 
Identifies the number of event counters implemented. 


@b@011 The core implements six event counters. 
(2) 


RESO, [10:7] 
RESO Reserved. 
LC, [6] 


Long cycle count enable. Determines which PMCCNTR bit generates an overflow recorded in 
PMOVSRJ[31]. The overflow event is generated on a 32-bit or 64-bit boundary. The possible 


values are: 

@be Overflow event is generated on a 32-bit boundary, when an increment changes 
PMCCNTRJ[31] from 1 to 0. This is the reset value. 

@b1 Overflow event is generated on a 64-bit boundary, when an increment changes 


PMCCNTR[63] from | to 0. 





DP, [5] 
Disable cycle counter CCNT when event counting is prohibited. The possible values are: 
@be Cycle counter operates regardless of the non-invasive debug authentication settings. 

This is the reset value. 

@b1 Cycle counter is disabled if non-invasive debug is not permitted and enabled. 

X, [4] 
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D, [3] 


C, [2] 


P, [1] 


E, [0] 


D4 AArch32 PMU Registers 
D4.4 PMCR, Performance Monitors Control Register 


Export enable. This bit permits events to be exported to another debug device, such as a trace 
macrocell, over an event bus. The possible values are: 


@be Export of events is disabled. This is the reset value. 
@b1 Export of events is enabled. 
No events are exported when counting is prohibited. 


This field does not affect the generation of Performance Monitors overflow interrupt requests or 
signaling to a cross-trigger interface (CTI) that can be implemented as signals exported from the 
PE. 


When this register has an architecturally defined reset value, if this field is implemented as an 
RW field, it resets to 0. 


Clock divider. The possible values are: 


@be When enabled, counter CCNT counts every clock cycle. This is the reset value. 
@b1 When enabled, counter CCNT counts once every 64 clock cycles. 


Cycle counter reset. This bit is WO. The effects of writing to this bit are: 
@be No action. This is the reset value. 

@b1 Reset PMCCNTR to zero. 

This bit is always RAZ. 


Resetting PMCCNTR does not clear the PMCCNTR overflow bit to 0. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile for more information. 


Event counter reset. This bit is WO. The effects of writing to this bit are: 


(7) No action. This is the reset value. 


@b1 Reset all event counters accessible in the current EL, not including PMCCNTR, to 
zero. 


This bit is always RAZ. 


In Non-secure ELO and EL1, a write of 1 to this bit does not reset event counters that 
HDCR.HPMN or MDCR_EL2.HPMN reserves for EL2 use. 


In EL2 and EL3, a write of 1 to this bit resets all the event counters. 


Resetting the event counters does not clear any overflow bits to 0. 


Enable. The possible values are: 


@be All counters that are accessible at Non-secure EL1, including PMCCNTR, are 
disabled. This is the reset value. 


@b1 When this register has an architecturally defined reset value, this field resets to 0. 
This bit is RW. 


This bit does not affect the operation of event counters that HDCR.HPMN or 
MDCR_EL2.HPMN reserves for EL2 use. 


When this register has an architecturally defined reset value, this field resets to 0. 
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D4 AArch32 PMU Registers 
D4.4 PMCR, Performance Monitors Control Register 


Configurations 


AArch32 System register PMCR is architecturally mapped to AArch64 System register 
PMCR_ELO. See D5.4 PMCR_ELO, Performance Monitors Control Register, ELO 
on page D5-671. 


AArch32 System register PMCR bits [6:0] are architecturally mapped to External register 
PMCR_ELO[6:0]. 


There is one instance of this register that is used in both Secure and Non-secure states. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined 
reset values. On a Warm or Cold reset these apply only if the PE resets into an Exception level 
that is using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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D4 AArch32 PMU Registers 
D4.4 PMCR, Performance Monitors Control Register 
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Chapter D5 
AArch64 PMU registers 


This chapter describes the AArch64 PMU registers and shows examples of how to use them. 


It contains the following sections: 


D5.1 AArch64 PMU register summary on page D5-662. 

D5.2 PMCEIDO_ELO0, Performance Monitors Common Event Identification Register 0, ELO 
on page D5-664. 

D5.3 PMCEID1_ELO, Performance Monitors Common Event Identification Register 1, ELO 
on page D5-668. 

D5.4 PMCR_ELO, Performance Monitors Control Register, ELO on page DS-671. 
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D5.1 AArch64 PMU register summary 


The PMU counters and their associated control registers are accessible in the AArch64 Execution state 


with MRS and MSR instructions. 


D5 AArch64 PMU registers 


D5.1 AArch64 PMU register summary 


The following table gives a summary of the Cortex-A55 PMU registers in the AArch64 Execution state. 
For those registers not described in this chapter, see the Arm® Architecture Reference Manual Armv8, for 


Armv8-A architecture profile. 


Table D5-1 PMU register summary in the AArch64 Execution state 





Name 


Type 


Width 


Reset 


Description 





PMCR_ELO 


RW 


32 


0x41453000 


D5.4 PMCR_ELO, 
Performance Monitors 
Control Register, ELO 
on page D5-671 





PMCNTENSET ELO 


RW 


32 


UNK 


Performance Monitors 
Count Enable Set 
Register 





PMCNTENCLR_ELO 


RW 


32 


UNK 


Performance Monitors 
Count Enable Clear 
Register 





PMOVSCLR_ELO 


RW 


32 


UNK 


Performance Monitors 
Overflow Flag Status 
Register 





PMSWINC ELO 


WO 


32 


UNK 


Performance Monitors 
Software Increment 
Register 





PMSELR_ ELO 


RW 


32 


UNK 


Performance Monitors 
Event Counter Selection 
Register 





PMCEIDO_ELO 


RO 


64 


UNK 


D5.2 PMCEIDO_ELO, 
Performance Monitors 
Common Event 
Identification Register 0, 
ELO on page D5-664 





PMCEID1_ ELO 


RO 


64 


UNK 


D5.3 PMCEID1_ELO, 
Performance Monitors 
Common Event 
Identification Register 1, 
ELO on page D5-668 





PMCCNTR_ELO 


RW 


64 


UNK 


Performance Monitors 
Cycle Count Register 





PMXEVTYPER ELO 








RW 





32 





UNK 





Performance Monitors 
Selected Event Type and 
Filter Register 
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D5 AArch64 PMU registers 
D5.1 AArch64 PMU register summary 


Table D5-1 PMU register summary in the AArch64 Execution state (continued) 














































































































Name Type Width Reset Description 

PMCCFILTR_ELO RW 32 UNK Performance Monitors 
Cycle Count Filter 
Register 

PMXEVCNTR_ELO RW 32 UNK Performance Monitors 
Selected Event Count 
Register 

PMUSERENR_ELO RW 32 UNK Performance Monitors 
User Enable Register 

PMINTENSET _EL1 RW 32 UNK Performance Monitors 
Interrupt Enable Set 
Register 

PMINTENCLR_EL1 RW 32 UNK Performance Monitors 
Interrupt Enable Clear 
Register 

PMOVSSET_ELO RW 32 UNK Performance Monitors 
Overflow Flag Status Set 
Register 

PMEVCNTRO_ ELO RW 32 UNK Performance Monitors 

PMEVCNTRI_ELO RW 32 UNK Evi Caunb Ree sich 

PMEVCNTR2_ELO RW 32 UNK 

PMEVCNTR3_ELO RW 32 UNK 

PMEVCNTR4 ELO RW 32 UNK 

PMEVCNTRS_ELO RW 32 UNK 

PMEVTYPERO_ELO RW 32 UNK Performance Monitors 

PMEVTYPERI ELO |RW 32 UNK Event Type Registers 

PMEVTYPER2_ ELO RW 32 UNK 

PMEVTYPER3_ELO RW 32 UNK 

PMEVTYPER4 ELO RW 32 UNK 

PMEVTYPERS_ELO RW 32 UNK 

PMCCFILTR_ELO RW 32 UNK Performance Monitors 
Cycle Count Filter 
Register 
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D5 AArch64 PMU registers 


D5.2 PMCEIDO_ELO, Performance Monitors Common Event Identification Register 0, ELO 















































D5.2 PMCEIDO_ELO, Performance Monitors Common Event Identification Register 
0, ELO 
The PMCEIDO_ELO defines which common architectural and common microarchitectural feature events 
are implemented. 
Bit field descriptions 
31 30 29 28 27 26 25 24 23 22 21 20191817161514131211109 876543210 
ID[314:0] 
Figure D5-1 PMCEIDO_ELO bit assignments 
ID[31:0], [31:0] 
Common architectural and microarchitectural feature events that can be counted by the PMU 
event counters. 
The following table shows the PMCEIDO_ELO bit assignments with event implemented or not 
implemented when the associated bit is set to 1 or 0. See the Arm® Architecture Reference 
Manual Armv8s, for Armv8-A architecture profile for more information about these events. 
Table D5-2 PMU events 
Bit | Event number | Event mnemonic Description 
[31] | Ox1F L1D_CACHE ALLOCATE L1 Data cache allocate: 
2) This event is not implemented. 

[30] | @x1E CHAIN Chain. For odd-numbered counters, counts once for each overflow of the 
preceding even-numbered counter. For even-numbered counters, does not 
count: 

1 This event is implemented. 

[29] | @x1D BUS_CYCLES Biseve: 

1 This event is implemented. 

[28] | @x1c TTBR_WRITE_RETIRED TTBR write, architecturally executed, condition check pass - write to 
translation table base: 

1 This event is implemented. 
[27] | @x1B INST_SPEC Instruction speculatively executed: 
1 This event is implemented. 
[26] | @x1A MEMORY _ ERROR Local memory error: 
1 This event is implemented. 
[25] | @x19 BUS_ACCESS Bas ancdes: 
1 This event is implemented. 
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Table D5-2 PMU events (continued) 
























































Bit | Event number | Event mnemonic Description 
[24] | 6x18 L2D_CACHE_WB L2 Data cache Write-Back: 

(2) This event is not implemented if the Cortex-A55 core has been 
configured without an L2 cache. 

1 This event is implemented if the Cortex-A55 core has been 
configured with an L2 cache. 

[23] | @x17 L2D_CACHE_REFILL L2 Data cache refill: 

2) This event is not implemented if the Cortex-A55 core has been 
configured without an L2 and L3 cache. If configured with only 
an L3 cache, the L3 event will become an L2 event. 

1 This event is implemented if the Cortex-A55 core has been 
configured with an L2 or L3 cache. 

[22] | 0x16 L2D_CACHE L2 Data cache access: 

) This event is not implemented if the Cortex-A55 core has been 
configured without an L2 and L3 cache. If configured with only 
an L3 cache, the L3 event will become an L2 event. 

1 This event is implemented if the Cortex-A55 core has been 
configured with an L2 or L3 cache. 

[21] | @x15 LID_CACHE_WB L1 Data cache Write-Back: 

1 This event is implemented. 
[20] | @x14 L1I_CACHE L1 Instruction cache access: 

1 This event is implemented. 
[19] | @x13 MEM_ACCESS Data memory access: 

1 This event is implemented. 

[18] | @x12 BR_PRED Predictable branch speculatively executed: 

1 This event is implemented. 

[17] | @x11 CPU_CYCLES Cycle: 

1 This event is implemented. 

[16] | @x19@ BR_MIS_PRED Mispredicted or not predicted branch speculatively executed: 

1 This event is implemented. 

[15] | @x@F UNALIGNED_LDST_RETIRED | Instruction architecturally executed, condition check pass - unaligned load 
or store: 

1 This event is implemented. 
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Table D5-2 PMU events (continued) 





















































Bit | Event number | Event mnemonic Description 
[14] | @x@E BR_RETURN_RETIRED Instruction architecturally executed, condition check pass - procedure 
return: 
1 This event is implemented. 
[13] | @x@D BR_IMMED_RETIRED Instruction architecturally executed - immediate branch: 
1 This event is implemented. 
[12] | @xec PC_WRITE_ RETIRED Instruction architecturally executed, condition check pass - software 
change of the PC: 
1 This event is implemented. 
[11] | @x@B CID_WRITE_RETIRED Instruction architecturally executed, condition check pass - write to 
CONTEXTIDR: 
1 This event is implemented. 
[10] | @x@A EXC_RETURN Instruction architecturally executed, condition check pass - exception 
return: 
1 This event is implemented. 
[9] | @x@9 EXC_TAKEN Exception taken: 
1 This event is implemented. 
[8] | 0x08 INST_RETIRED Instruction architecturally executed: 
1 This event is implemented. 
[7] | @x@7 ST_RETIRED Instruction architecturally executed, condition check pass - store: 
1 This event is implemented. 
[6] | @x@6 LD_RETIRED Instruction architecturally executed, condition check pass - load: 
1 This event is implemented. 
[5] | @x@5 LID_TLB_REFILL LI Data TLB refill: 
1 This event is implemented. 
[4] | @xe4 LID_CACHE L1 Data cache access: 
1 This event is implemented. 
[3] | @xe3 L1D_CACHE _ REFILL L1 Data cache refill: 
1 This event is implemented. 
[2] | @xe2 L1I_TLB_REFILL L1 Instruction TLB refill: 





1 This event is implemented. 
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Table D5-2 PMU events (continued) 














Bit | Event number | Event mnemonic Description 
[1] | @x@1 L1I_CACHE_REFILL L1 Instruction cache refill: 
1 This event is implemented. 
[0] | @xee SW_INCR Instruction architecturally executed, condition check pass - software 








increment: 


1 This event is implemented. 











Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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D5.3 PMCEID1_ELO, Performance Monitors Common Event Identification Register 
1, ELO 
The PMCEID1_ELO defines which common architectural and common microarchitectural feature events 
are implemented. 
Bit field descriptions 
31 30 29 28 27 26 25 24 23 22 21 20191817 161514131211109 8 76543 21 0 
ID[63:32] 
Figure D5-2 PMCEID1_EL0 bit assignments 
ID[63:32], [31:0] 
Common architectural and microarchitectural feature events that can be counted by the PMU 
event counters. 
For each bit described in the following table, the event is implemented if the bit is set to 1, or 
not implemented if the bit is set to 0. 
Table D5-3 PMU common events 
Bit | Event number | Event mnemonic Description 
[24] | 0x38 REMOTE ACCESS RD | Access to another socket in a multi-socket system. 
1 This event is implemented. 
[23] | @x37 LL_CACHE_MISS_RD Last Level cache miss, read. 
1 This event is implemented. 
[22] | 0x36 LL_CACHE_RD Last Level cache access, read. 
1 This event is implemented. 
[21] | @x35 ITLB_WALK Access to instruction TLB that caused a page table walk. 
1 This event is implemented. 
[20] | 0x34 DTLB_WALK Access to data TLB that caused a page table walk. 
1 This event is implemented. 
[16] | @x30 L2I_TLB Attributable Level 2 instruction TLB access. 
) This event is not implemented. 
[15] | @x2F L2D_TLB Attributable Level 2 data or unified TLB access. 
1 This event is implemented. 
[14] | @x2E L2L TLB_REFILL Attributable Level 2 instruction TLB refill. 
) This event is not implemented. 
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Table D5-3 PMU common events (continued) 












































Bit | Event number | Event mnemonic Description 
[13] ) @x2D L2D_TLB_ REFILL Attributable Level 2 data or unified TLB refill. 
1 This event is implemented. 
[12] | @x2c L3D_CACHE_WB Attributable Level 3 data or unified cache write-back. 
7) This event is not implemented. 
[11] | @x2B L3D_CACHE Attributable Level 3 data or unified cache access. 
1 This event is implemented if L2 and L3 are present. 
@ This event is not implemented if L2 and L3 are not present. 
[10] | @x2A L3D_CACHE_REFILL Attributable Level 3 data or unified cache refill. 
1 This event is implemented if L2 and L3 are present. 
@ This event is not implemented if L2 and L3 are not present. 
[9] | @x29 L3D_CACHE_ALLOCATE | Attributable Level 3 data or unified cache allocation without refill. 
1 This event is implemented if L2 and L3 are present. 
@ This event is not implemented if L2 and L3 are not present. 
[8] | 0x28 L21_ CACHE REFILL Attributable Level 2 instruction cache refill. 
7) This event is not implemented. 
[7] | 0x27 L21_ CACHE Attributable Level 2 instruction cache access. 
7) This event is not implemented. 
[6] | @x26 L1I_TLB Level | instruction TLB access. 
1 This event is implemented. 
[5] | @x25 L1D_TLB Level | data or unified TLB access. 
1 This event is implemented. 
[4] | 0x24 STALL_BACKEND No operation issued due to backend. 
1 This event is implemented. 
[3] | 0x23 STALL_FRONTEND No operation issued due to the frontend. 
1 This event is implemented. 
[2] | @x22 








BR_MIS_ PRED RETIRED | Instruction architecturally executed, mispredicted branch. 


1 This event is implemented. 
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Table D5-3 PMU common events (continued) 





Bit | Event number 


Event mnemonic 


Description 








[1] | @x22 BR_RETIRED Instruction architecturally executed, branch. 
1 This event is implemented. 
[0] | @x2@ L2D_CACHE_ALLOCATE | Level 2 data cache allocation without refill. 








1 This event is implemented. 








Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 
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D5.4 PMCR_ELO, Performance Monitors Control Register, ELO 


The PMCR_ELO provides details of the Performance Monitors implementation, including the number of 
counters implemented, and configures and controls the counters. 


Bit field descriptions 


24 23 1615 11 10 76543 2 1 0 





RESO 


Figure D5-3 PMCR_ELO bit assignments 
IMP, [31:24] 
Implementer code: 


@x41 Arm. 


This is a read-only field. 
IDCODE, [23:16] 

Identification code: 

@x45 Cortex-A55. 

This is a read-only field. 
N, [15:11] 

Number of event counters. 

@bee118 Six counters. 
RESO, [10:7] 

RESO Reserved. 
LC, [6] 


Long cycle count enable. Determines which PMCCNTR_ELO bit generates an overflow 
recorded in PMOVSRJ[31]. The possible values are: 





7) Overflow on increment that changes PMCCNTR_ELO[31] from 1 to 0. 
1 Overflow on increment that changes PMCCNTR_ELO[63] from | to 0. 

DP, [5] 
Disable cycle counter, PMCCNTR_ELO when event counting is prohibited: 
) Cycle counter operates regardless of the non-invasive debug authentication settings. 

This is the reset value. 

1 Cycle counter is disabled if non-invasive debug is not permitted and enabled. 
This bit is read/write. 

X, [4] 
Export enable. This bit permits events to be exported to another debug device, such as a trace 
macrocell, over an event bus: 
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) Export of events is disabled. This is the reset value. 


1 Export of events is enabled. 


This bit is read/write and does not affect the generation of Performance Monitors interrupts on 
the nPMUIRQ pin. 


D, [3] 
Clock divider: 
) When enabled, PMCCNTR_ELO counts every clock cycle. This is the reset value. 
1 When enabled, PMCCNTR_ELO counts every 64 clock cycles. 
This bit is read/write. 
C, [2] 
Clock counter reset. This bit is WO. The effects of writing to this bit are: 
7) No action. This is the reset value. 
1 Reset PMCCNTR_ELO to 0. 
This bit is always RAZ. 


Resetting PMCCNTR_ELO does not clear the PMCCNTR_ELO overflow bit to 0. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile for more information. 


P, [1] 
Event counter reset. This bit is WO. The effects of writing to this bit are: 
) No action. This is the reset value. 
1 Reset all event counters, not including PMCCNTR_ELO, to zero. 
This bit is always RAZ. 


In Non-secure ELO and EL1, a write of 1 to this bit does not reset event counters that 
MDCR_EL2.HPMN reserves for EL2 use. 


In EL2 and EL3, a write of 1 to this bit resets all the event counters. 
Resetting the event counters does not clear any overflow bits to 0. 
E, [0] 
Enable. The possible values of this bit are: 
@ All counters, including PMCCNTR_ELO, are disabled. This is the reset value. 
1 All counters are enabled. 
This bit is RW. 


In Non-secure ELO and EL1, this bit does not affect the operation of event counters that 
MDCR_EL2.HPMN reserves for EL2 use. 


On Warm reset, the field resets to 0. 
Configurations 


AArch64 System register PMCR_ELO is architecturally mapped to AArch32 System register 
PMCR. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 
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Chapter D6 
Memory-mapped PMU registers 


This chapter describes the memory-mapped PMU registers and shows examples of how to use them. 


It contains the following sections: 

¢« D6.1 Memory-mapped PMU register summary on page D6-674. 

¢ D6.2 PMCFGR, Performance Monitors Configuration Register on page D6-678. 

¢« D6.3 PMCIDRO, Performance Monitors Component Identification Register 0 on page D6-679. 
¢ D6.4 PMCIDRI1, Performance Monitors Component Identification Register 1 on page D6-680. 
¢ D6.5 PMCIDR2, Performance Monitors Component Identification Register 2 on page D6-681. 
¢ D6.6 PMCIDR3, Performance Monitors Component Identification Register 3 on page D6-682. 
¢ D6.7 PMPIDRO, Performance Monitors Peripheral Identification Register 0 on page D6-683. 
¢ D6.8 PMPIDR1, Performance Monitors Peripheral Identification Register I on page D6-684. 
¢ D6.9 PMPIDR2, Performance Monitors Peripheral Identification Register 2 on page D6-685. 
¢ D6.10 PMPIDR3, Performance Monitors Peripheral Identification Register 3 on page D6-686. 
¢« D6.11 PMPIDR4, Performance Monitors Peripheral Identification Register 4 on page D6-687. 
¢ D6.12 PMPIDRn», Performance Monitors Peripheral Identification Register 5-7 on page D6-688. 
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D6 Memory-mapped PMU registers 
D6.1 Memory-mapped PMU register summary 


There are PMU registers that are accessible through the external debug interface. 


These registers are listed in the following table. For those registers not described in this chapter, see the 
Arm® Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


Table D6-1 Memory-mapped PMU register summary 








































































































Offset Name Type Description 
8x00 PMEVCNTRO_ELO RW Performance Monitor Event Count Register 
0 
@x0e4 - - Reserved 
@xee8 PMEVCNTR1_ELO RW Performance Monitor Event Count Register 
1 
@x@OC - - Reserved 
@x010 PMEVCNTR2_ELO RW Performance Monitor Event Count Register 
2 
@xe14 - - Reserved 
0x018 PMEVCNTR3_ELO RW Performance Monitor Event Count Register 
3 
@x@1C 7 - Reserved 
@x020 PMEVCNTR4_ELO RW Performance Monitor Event Count Register 
4 
@x024 - - Reserved 
@x028 PMEVCNTR5_ELO RW Performance Monitor Event Count Register 
5 
@x@2C-OxF4 - - Reserved 
OxOF8 PMCCNTR_ELO[31:0] RW Performance Monitor Cycle Count Register 
OxOFC PMCCNTR_ELO0[63:32] RW 
@x200 PMPCSRJ31:0] RO Program Counter Sample Register 
@x204 PMPCSR[63:32] 
Qx208 PMCIDISR RO CONTEXTIDR_EL1 Sample Register 
@x20C PMVIDSR RO VMID Sample Register 
@x220 PMPCSR[31:0] RO Program Counter Sample Register (alias) 
@x224 PMPCSR[63:32] 
Qx228 PMCIDISR RO CONTEXTIDR_EL1 Sample Register 
(alias) 
@x22C PMCID2SR RO CONTEXTIDR_EL2 Sample Register 
@x100-Ox3FC - - Reserved 
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Table D6-1 Memory-mapped PMU register summary (continued) 






















































































Offset Name Type Description 

@x418-0x478 - - Reserved 

@x47C PMCCFILTR_ELO RW Performance Monitor Cycle Count Filter 
Register 

0x600 PMPCSSR_LO RO D7.2 PMPCSSR, Snapshot Program 

ex6od4 PMPCSSR_HI RO Counter Sample Register on page D7-691 

@x608 PMCIDSSR RO D7.3 PMCIDSSR, Snapshot 
CONTEXTIDR_ELI Sample Register 
on page D7-692 

@x60C PMCID2SSR RO D7.4 PMCID2SSR, Snapshot 
CONTEXTIDR_EL2 Sample Register 
on page D7-693 

@x610 PMSSSR RO D7.5 PMSSSR, PMU Snapshot Status 
Register on page D7-694 

@x614 PMOVSSR RO D7.6 PMOVSSR, PMU Overflow Status 
Snapshot Register on page D7-695 

@x618 PMCCNTSR_LO RO D7.7 PMCCNTSR, PMU Cycle Counter 

ex61c PMCCNTSR_HI RO Snapshot Register on page D7-696 

@x620+ 4xn PMEVCNTSRn RO D7.8 PMEVCNTSRn, PMU Cycle Counter 
Snapshot Registers 0-5 on page D7-697 

Ox6FO PMSSCR WO D7.9 PMSSCR, PMU Snapshot Capture 
Register on page D7-698 

@xCee PMCNTENSET_ELO RW Performance Monitor Count Enable Set 
Register 

@xC@4-8xC1C = - Reserved 

@xC20 PMCNTENCLR_ELO RW Performance Monitor Count Enable Clear 
Register 

@xC24-@xC3C 2 - Reserved 

8xC40 PMINTENSET ELI RW Performance Monitor Interrupt Enable Set 
Register 

@xC44-@xC5C - - Reserved 

@xC60 PMINTENCLR ELI RW Performance Monitor Interrupt Enable 
Clear Register 

@xC64-@xC7C - - Reserved 

@xC80 PMOVSCLR_ELO RW Performance Monitor Overflow Flag Status 
Register 

@xC84-@xC9C - - Reserved 

@xCA@ PMSWINC_ELO wo Performance Monitor Software Increment 
Register 
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Table D6-1 Memory-mapped PMU register summary (continued) 































































































Offset Name Type Description 

@xCA4-@xCBC - - Reserved 

e@xCCce PMOVSSET_ELO RW Performance Monitor Overflow Flag Status 
Set Register 

@xCC4-@xDFC - - Reserved 

@xE@O PMCFGR RO D6.2 PMCFGR, Performance Monitors 
Configuration Register on page D6-678 

@xE@4 PMCR_ELO RW Performance Monitors Control Register. 
This register is distinct from the 
PMCR_ELO system register. It does not 
have the same value. 

@xE@8-OxE1C - - Reserved 

@xE20 PMCEIDO RO D5.2 PMCEIDO_ELO, Performance 
Monitors Common Event Identification 
Register 0, ELO on page D5-664 

@xE24 PMCEID1 RO D5.3 PMCEID1_ELO, Performance 
Monitors Common Event Identification 
Register 1, ELO on page D5-668 

@xE28 PMCEID2 RO Reserved 

@xE2C PMCEID3 RO Reserved 

@xFA4 - - Reserved 

OxFA8 PMDEVAFFO RO B2.90 MPIDR_EL1, Multiprocessor 
Affinity Register, ELI on page B2-434 

@xFAC PMDEVAFF 1 RO B2.90 MPIDR_EL1, Multiprocessor 
Affinity Register, EL1 on page B2-434 

OxFB8 PMAUTHSTATUS RO Performance Monitor Authentication Status 
Register 

@xFBC PMDEVARCH RO Performance Monitor Device Architecture 
Register 

@xFC@-OxFC8 - - Reserved 

@xFCC PMDEVTYPE RO Performance Monitor Device Type Register 

@xFDO PMPIDR4 RO D6.11 PMPIDR4, Performance Monitors 
Peripheral Identification Register 4 
on page D6-687 

@xFD4 PMPIDRS RO D6.12 PMPIDRn, Performance Monitors 

@xFDS PMPIDR6 RO Peripheral Identification Register 5-7 
on page D6-688 

@xFDC PMPIDR7 RO 

Q@xFEO PMPIDRO RO D6.7 PMPIDRO, Performance Monitors 
Peripheral Identification Register 0 
on page D6-683 
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Table D6-1 Memory-mapped PMU register summary (continued) 





Offset Name Type Description 





OxFE4 PMPIDRI1 RO D6.8 PMPIDR1, Performance Monitors 
Peripheral Identification Register 1 
on page D6-684 





@xFE8 PMPIDR2 RO D6.9 PMPIDR2, Performance Monitors 
Peripheral Identification Register 2 
on page D6-685 





@xFEC PMPIDR3 RO D6.10 PMPIDR3, Performance Monitors 
Peripheral Identification Register 3 
on page D6-686 





OxFFO PMCIDRO RO D6.3 PMCIDRO, Performance Monitors 
Component Identification Register 0 
on page D6-679 





OxFF4 PMCIDRI1 RO D6.4 PMCIDRI1, Performance Monitors 
Component Identification Register 1 
on page D6-680 





OxFF8 PMCIDR2 RO D6.5 PMCIDR2, Performance Monitors 
Component Identification Register 2 
on page D6-681 





OxFFC PMCIDR3 RO D6.6 PMCIDR3, Performance Monitors 
Component Identification Register 3 
on page D6-682 
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D6.2 PMCFGR, Performance Monitors Configuration Register 
The PMCFGR contains PMU specific configuration data. 


Bit field descriptions 
The PMCFGR is a 32-bit register. 


31 17 16 15 14 13 8 7 0 


L_cec 
RESO CCD 
EX 


Figure D6-1 PMCFGR bit assignments 
RESO, [31:17] 


RESO Reserved. 
EX, [16] 

Export supported. The value is: 

1 Export is supported. PMCR_ELO.EX is read/write. 
CCD, [15] 

Cycle counter has pre-scale. The value is: 

1 PMCR_ELO.D is read/write. 
CC, [14] 

Dedicated cycle counter supported. The value is: 

1 Dedicated cycle counter is supported. 
Size, [13:8] 


Counter size. The value is: 
@b111111 64-bit counters. 
N, [7:0] 
Number of event counters. The value is: 


@x0@6 Six counters. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The PMCFGR can be accessed through the external debug interface, offset @xEee. 
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D6.3 PMCIDRO, Performance Monitors Component Identification Register 0 
The PMCIDRO provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMCIDR0O is a 32-bit register. 


31 8 7 0 


RESO 


Figure D6-2 PMCIDRO bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL_ 0, [7:0] 
@x@D Preamble byte 0. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The PMCIDRO can be accessed through the external debug interface, offset @xFF®. 
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D6.4 PMCIDR1, Performance Monitors Component Identification Register 1 


The PMCIDRI provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMCIDR1 is a 32-bit register. 


31 8 7 4 3 0 
RESO 


Figure D6-3 PMCIDR1 bit assignments 
RESO, [31:8] 
RESO Reserved. 
CLASS, [7:4] 
@x9 Debug component. 
PRMBL._1, [3:0] 
@x® Preamble byte 1. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The PMCIDRI can be accessed through the external debug interface, offset @xFF4. 
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D6.5 PMCIDR2, Performance Monitors Component Identification Register 2 
The PMCIDR2 provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMCIDR2 is a 32-bit register. 


31 8 7 0 


RESO 


Figure D6-4 PMCIDR2 bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL 2, [7:0] 
@x@5 ~~ Preamble byte 2. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The PMCIDR2 can be accessed through the external debug interface, offset @xFF8. 
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D6 Memory-mapped PMU registers 
D6.6 PMCIDR3, Performance Monitors Component Identification Register 3 


D6.6 PMCIDR3, Performance Monitors Component Identification Register 3 
The PMCIDR3 provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMCIDR3 is a 32-bit register. 


31 8 7 0 


RESO 


Figure D6-5 PMCIDR3 bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL_ 3, [7:0] 
@xB1 Preamble byte 3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The PMCIDR3 can be accessed through the external debug interface, offset @xFFC. 
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D6 Memory-mapped PMU registers 
D6.7 PMPIDRO, Performance Monitors Peripheral Identification Register 0 


D6.7 PMPIDRO, Performance Monitors Peripheral Identification Register 0 
The PMPIDRO provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMPIDR0O is a 32-bit register. 


31 8 7 0 


a 


RESO 


Figure D6-6 PMPIDRO bit assignments 
RESO, [31:8] 
RESO Reserved. 
Part_0, [7:0] 


@x@5 _— Least significant byte of the performance monitor part number. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The PMPIDRO can be accessed through the external debug interface, offset @xFE@. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D6-683 
reserved. 
Non-Confidential 


D6 Memory-mapped PMU registers 
D6.8 PMPIDR1, Performance Monitors Peripheral Identification Register 1 


D6.8 PMPIDR1, Performance Monitors Peripheral Identification Register 1 
The PMPIDR1 provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMPIDR1 is a 32-bit register. 


31 8 7 4 3 0 


RESO 


Figure D6-7 PMPIDR1 bit assignments 
RESO, [31:8] 
RESO Reserved. 
DES_0, [7:4] 
@xB Arm Limited. This is the least significant nibble of JEP106 ID code. 
Part_1, [3:0] 


@xD Most significant nibble of the performance monitor part number. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The PMPIDRI can be accessed through the external debug interface, offset @xFE4. 
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D6 Memory-mapped PMU registers 
D6.9 PMPIDR2, Performance Monitors Peripheral Identification Register 2 


D6.9 PMPIDR2, Performance Monitors Peripheral Identification Register 2 


The PMPIDR2 provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMPIDR2 is a 32-bit register. 


31 8 7 432 0 
JEDEC —! 
RESO 


Figure D6-8 PMPIDR2 bit assignments 
RESO, [31:8] 
RESO Reserved. 
Revision, [7:4] 


@x2 12p0. 


JEDEC, [3] 
@b1 RAO. Indicates a JEP 106 identity code is used. 
DES_1, [2:0] 
@be11 Arm Limited. This is the most significant nibble of JEP106 ID code. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The PMPIDR2 can be accessed through the external debug interface, offset @xFE8. 
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D6 Memory-mapped PMU registers 
D6.10 PMPIDR3, Performance Monitors Peripheral Identification Register 3 


D6.10 PMPIDR3, Performance Monitors Peripheral Identification Register 3 


The PMPIDR3 provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMPIDR3 is a 32-bit register. 


31 8 7 4 3 0 
RESO 


Figure D6-9 PMPIDR3 bit assignments 
RESO, [31:8] 


RESO Reserved. 


REVAND, [7:4] 


@xe Part minor revision. 
CMOD, [3:0] 
@xe Customer modified. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The PMPIDR3 can be accessed through the external debug interface, offset @xFEC. 
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D6 Memory-mapped PMU registers 
D6.11 PMPIDR4, Performance Monitors Peripheral Identification Register 4 


D6.11 | PMPIDR4, Performance Monitors Peripheral Identification Register 4 
The PMPIDR4 provides information to identify a Performance Monitor component. 


Bit field descriptions 
The PMPIDR4 is a 32-bit register. 


31 8 7 4 3 0 


RESO 


Figure D6-10 PMPIDR4 bit assignments 
RESO, [31:8] 
RESO Reserved. 
Size, [7:4] 


@x® Size of the component. Log, the number of 4KB pages from the start of the 
component to the end of the component ID registers. 


DES 2, [3:0] 
@x4 Arm Limited. This is the least significant nibble JEP 106 continuation code. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The PMPIDR4 can be accessed through the external debug interface, offset @xFD@. 
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D6 Memory-mapped PMU registers 
D6.12 PMPIDRn, Performance Monitors Peripheral Identification Register 5-7 


D6.12 PMPIDRn, Performance Monitors Peripheral Identification Register 5-7 
No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 
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Chapter D7 
PMU snapshot registers 


PMU snapshot registers are an IMPLEMENTATION DEFINED extension to an Armv8-A compliant PMU to 
support an external core monitor that connects to a system profiler. 


It contains the following sections: 

¢ D7.1 PMU snapshot register summary on page D7-690. 

¢ D7.2 PMPCSSR, Snapshot Program Counter Sample Register on page D7-691. 

¢ D7.3 PMCIDSSR, Snapshot CONTEXTIDR_ELI Sample Register on page D7-692. 
¢ D7.4 PMCID2SSR, Snapshot CONTEXTIDR_EL2 Sample Register on page D7-693. 
¢ D7.5 PMSSSR, PMU Snapshot Status Register on page D7-694. 

¢ D7.6 PMOVSSR, PMU Overflow Status Snapshot Register on page D7-695. 

¢ D7.7 PMCCNTSR, PMU Cycle Counter Snapshot Register on page D7-696. 

¢ D7.8 PMEVCNTSRn, PMU Cycle Counter Snapshot Registers 0-5 on page D7-697. 
¢ D7.9 PMSSCR, PMU Snapshot Capture Register on page D7-698. 
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D7 PMU snapshot registers 
D7.1 PMU snapshot register summary 






































D7.1 PMU snapshot register summary 
The snapshot registers are visible in an IMPLEMENTATION DEFINED region of the PMU external debug 
interface. Each time the debugger sends a snapshot request, information is collected to see how the code 
is executed in the different cores. 
The following table describes the PMU snapshot registers implemented in the core. 
Table D7-1 PMU snapshot register summary 
Offset Name Type | Width | Description 
0x600 PMPCSSR LO |RO_ | 32 D7.2 PMPCSSR, Snapshot Program Counter Sample Register on page D7-691 
0x604 PMPCSSR_HI RO |32 
@x608 PMPCIDSSR RO |32 D7.3 PMCIDSSR, Snapshot CONTEXTIDR_EL1 Sample Register on page D7-692 
@x60C PMPCID2SSR RO |32 D7.4 PMCID2SSR, Snapshot CONTEXTIDR_EL2 Sample Register 
on page D7-693 
0x610 PMSSSR RO |32 D7.5 PMSSSR, PMU Snapshot Status Register on page D7-694 
@x614 PMOVSSR RO | 32 D7.6 PMOVSSR, PMU Overflow Status Snapshot Register on page D7-695 
@x618 PMCCNTSR_LO|RO- | 32 D7.7 PMCCNTSR, PMU Cycle Counter Snapshot Register on page D7-696 
0x61C PMCCNTSR_HI |RO- | 32 
@x620+ 4xn|PMEVCNTSRn |RO- | 32 D7.8 PMEVCNTSRn, PMU Cycle Counter Snapshot Registers 0-5 
on page D7-697 
Ox6FO PMSSCR WO | 32 D7.9 PMSSCR, PMU Snapshot Capture Register on page D7-698 
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D7 PMU snapshot registers 
D7.2 PMPCSSR, Snapshot Program Counter Sample Register 


D7.2 PMPCSSR, Snapshot Program Counter Sample Register 
The PMPCSSR is an alias for the PCSR register. 


However, unlike the other view of PCSR, it is not sensitive to reads. That is, reads of PMPCSSR through 
the PMU snapshot view do not cause a new sample capture and do not change CIDSR, CID2SR, or 
VIDSR. 

Bit field descriptions 


The PMPCSSR is a 64-bit read-only register. 


63 62 61 60 56 55 0 
L_NsS 
RESO 


Figure D7-1 PMPCSSR bit assignments 
NS, [63] 


Non-secure sample. 


EL, [62:61] 
Exception level sample. 


RESO, [60:56] 
Reserved, RESO. 


PC, [55:0] 
Sampled PC. 


Configurations 
There are no configuration notes. 


Usage constraints 
Any access to PMPCSSR returns an error if any of the following occurs: 


¢ The core power domain is off. 
¢ DoubleLockStatus() == TRUE. 
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D7 PMU snapshot registers 
D7.3 PMCIDSSR, Snapshot CONTEXTIDR_EL1 Sample Register 


D7.3 PMCIDSSR, Snapshot CONTEXTIDR_EL1 Sample Register 
The PMCIDSSR is an alias for the CIDSR register. 


Configurations 


There are no configuration notes. 


Usage constraints 
Any access to PMCIDSSR returns an error if any of the following occurs: 


¢ The core power domain is off. 
* DoubleLockStatus() == TRUE. 
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D7 PMU snapshot registers 
D7.4 PMCID2SSR, Snapshot CONTEXTIDR_EL2 Sample Register 


D7.4 PMCID2SSR, Snapshot CONTEXTIDR_EL2 Sample Register 
The PMCID2SSR is an alias for the CID2SR register. 


Configurations 


There are no configuration notes. 


Usage constraints 
Any access to PMCID2SSR returns an error if any of the following occurs: 


¢ The core power domain is off. 
* DoubleLockStatus() == TRUE. 
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D7 PMU snapshot registers 
D7.5 PMSSSR, PMU Snapshot Status Register 


D7.5 PMSSSR, PMU Snapshot Status Register 


The PMSSSR holds status information about the captured counters. 


Bit field descriptions 
The PMSSSR is a 32-bit read-only register. 


31 10 
Nc— 
RESO 


Figure D7-2 PMSSSR bit assignments 


RESO, [31:1] 


NC, [0] 


Reserved, RESO. 


No capture. This bit indicates whether the PMU counters have been captured. The possible 
values are: 


0 PMU counters are captured. 


1 PMU counters are not captured. 


If there is a security violation, the core does not capture the event counters. The external monitor 
is responsible for keeping track of whether it managed to capture the snapshot registers from the 
core. 


This bit does not reflect the status of the captured Program Counter Sample registers. 


The core resets this bit to 1 by a Warm reset but MPSSSR.NC is overwritten at the first capture. 


Configurations 


There are no configuration notes. 


Usage constraints 
Any access to PMSSSR returns an error if any of the following occurs: 


The core power domain is off. 
DoubleLockStatus() == TRUE. 
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D7 PMU snapshot registers 
D7.6 PMOVSSR, PMU Overflow Status Snapshot Register 


D7.6 PMOVSSR, PMU Overflow Status Snapshot Register 
The PMOVSSR is a captured copy of PMOVSR. 


Once it is captured, the value in PMOVSSR is unaffected by writes to PMOVSSET_ELO and 
PMOVSCLR_ELO. 


Configurations 


There are no configuration notes. 


Usage constraints 
Any access to PMOVSSR returns an error if any of the following occurs: 


¢ The core power domain is off. 
¢« DoubleLockStatus() == TRUE. 
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D7 PMU snapshot registers 
D7.7 PMCCNTSR, PMU Cycle Counter Snapshot Register 


D7.7 PMCCNTSR, PMU Cycle Counter Snapshot Register 
The PMCCNTSR is a captured copy of PMCCNTR_ELO. 


Once it is captured, the value in PMCCNTSR is unaffected by writes to PMCCNTR_ELO and 
PMCR_ELO.C. 


Configurations 


There are no configuration notes. 


Usage constraints 
Any access to PMCCNTSR returns an error if any of the following occurs: 


¢ The core power domain is off. 
¢« DoubleLockStatus() == TRUE. 
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D7 PMU snapshot registers 
D7.8 PMEVCNTSRn, PMU Cycle Counter Snapshot Registers 0-5 


D7.8 PMEVCNTSRn, PMU Cycle Counter Snapshot Registers 0-5 
The PMEVCNTSRza, are captured copies of PMEVCNTRn_ELO, n is 0-5. 


When they are captured, the value in PMSSEVCNTRn is unaffected by writes to PMSSEVCNTRn_ELO 
and PMCR_ELO.P. 


Configurations 


There are no configuration notes. 


Usage constraints 

Any access to PMSSEVCNTRn returns an error if any of the following occurs: 
¢ The core power domain is off. 

¢ DoubleLockStatus() == TRUE. 
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D7 PMU snapshot registers 
D7.9 PMSSCR, PMU Snapshot Capture Register 


PMSSCR, PMU Snapshot Capture Register 


The PMSSCR provides a mechanism for software to initiate a sample. 


Bit field descriptions 
The PMSSCR is a 32-bit write-only register. 


31 10 
ss— 
RESO 


Figure D7-3 PMSSCR bit assignments 


RESO, [31:1] 

Reserved, RESO. 
SS, [0] 

Capture now. The possible values are: 

0 IGNORED. 

1 Initiate a capture immediately. 
Configurations 


There are no configuration notes. 


Usage constraints 
Any access to PMSSCR returns an error if any of the following occurs: 


¢ The core power domain is off. 
*« DoubleLockStatus() == TRUE. 
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Chapter D8 
ETM registers 


This chapter describes the ETM registers. 


It contains the following sections: 


D8&.1 ETM register summary on page D8-701. 


D8.2 TRCACATRn, Address Comparator Access Type Registers 0-7 on page D8-705. 


D8.3 TRCACVRn, Address Comparator Value Registers 0-7 on page D8-707. 
D8.4 TRCAUTHSTATUS, Authentication Status Register on page D8-708. 
D8.5 TRCAUXCTLR, Auxiliary Control Register on page D8-709. 

D8.6 TRCBBCTLR, Branch Broadcast Control Register on page D8-711. 
D8.7 TRCCCCTLR, Cycle Count Control Register on page D8-712. 


D8.8 TRCCIDCCTLRO, Context ID Comparator Control Register 0 on page D8-713. 


D8.9 TRCCIDCVRO, Context ID Comparator Value Register 0 on page D8-714. 
D8.10 TRCCIDRO, ETM Component Identification Register 0 on page D8-715. 
D8.11 TRCCIDR1, ETM Component Identification Register 1 on page D8-716. 
D8.12 TRCCIDR2, ETM Component Identification Register 2 on page D8-717. 
D8.13 TRCCIDR3, ETM Component Identification Register 3 on page D8-718. 
D8.14 TRCCLAIMCLR, Claim Tag Clear Register on page D8-719. 

D8.15 TRCCLAIMSET, Claim Tag Set Register on page D8-720. 

D8.16 TRCCNTCTLRO, Counter Control Register 0 on page D8-721. 

D8.17 TRCCNTCTLR1, Counter Control Register I on page D8-723. 

D8.18 TRCCNTRLDVRn, Counter Reload Value Registers 0-1 on page D8-725. 
D8.19 TRCCNTVRn, Counter Value Registers 0-1 on page D8-726. 

D8.20 TRCCONFIGR, Trace Configuration Register on page D8-727. 

D8.21 TRCDEVAFFO, Device Affinity Register 0 on page D8-730. 

D8.22 TRCDEVAFF1, Device Affinity Register 1 on page D8-732. 

D8.23 TRCDEVARCH, Device Architecture Register on page D8-733. 
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D8 ETM registers 


D8&.24 TRCDEVID, Device ID Register on page D8-734. 

D8&.25 TRCDEVTYPE, Device Type Register on page D8-735. 

D8.26 TRCEVENTCTLOR, Event Control 0 Register on page D8-736. 

D8.27 TRCEVENTCTLIR, Event Control I Register on page D8-738. 

D8.28 TRCEXTINSELR, External Input Select Register on page D8-739. 

D&.29 TRCIDRO, ID Register 0 on page D8-740. 

D8&.30 TRCIDRI, ID Register 1 on page D8-742. 

D8.31 TRCIDR2, ID Register 2 on page D8-743. 

D8&.32 TRCIDR3, ID Register 3 on page D8-745. 

D8&.33 TRCIDR4, ID Register 4 on page D8-747. 

D8&.34 TRCIDRS5, ID Register 5 on page D8-749. 

D8&.35 TRCIDRS, ID Register 8 on page D8-751. 

D8.36 TRCIDRY, ID Register 9 on page D8-752. 

D8&.37 TRCIDR10, ID Register 10 on page D8-753. 

D8.38 TRCIDR1I, ID Register 11 on page D8-754. 

D8.39 TRCIDR12, ID Register 12 on page D8-755. 

D8&.40 TRCIDR13, ID Register 13 on page D8-756. 

D8.41 TRCIMSPECO, IMPLEMENTATION SPECIFIC Register 0 on page D8-757. 
D8.42 TRCITATBIDR, Integration ATB Identification Register on page D8-758. 
D8.43 TRCITCTRL, Integration Mode Control Register on page D8-759. 

D8.44 TRCITIATBINR, Integration Instruction ATB In Register on page D8-760. 
D8&.45 TRCITIATBOUTR, Integration Instruction ATB Out Register on page D8-761. 
D8&.46 TRCITIDATAR, Integration Instruction ATB Data Register on page D8-762. 
D8.47 TRCLAR, Software Lock Access Register on page D8-763. 

D8.48 TRCLSR, Software Lock Status Register on page D8-764. 

D8.49 TRCCNTVRn, Counter Value Registers 0-1 on page D8-765. 

D8.50 TRCOSLAR, OS Lock Access Register on page D8-766. 

D8.51 TRCOSLSR, OS Lock Status Register on page D8-767. 

D8.52 TRCPDCR, Power Down Control Register on page D8-768. 

D&.53 TRCPDSR, Power Down Status Register on page D8-769. 

D8.54 TRCPIDRO, ETM Peripheral Identification Register 0 on page D8-770. 
D8.55 TRCPIDRI, ETM Peripheral Identification Register 1 on page D8-771. 
D8.56 TRCPIDR2, ETM Peripheral Identification Register 2 on page D8-772. 
D8.57 TRCPIDR3, ETM Peripheral Identification Register 3 on page D8-773. 
D8.58 TRCPIDR4, ETM Peripheral Identification Register 4 on page D8-774. 
D8.59 TRCPIDRn, ETM Peripheral Identification Registers 5-7 on page D8-775. 
D8.60 TRCPRGCTLR, Programming Control Register on page D8-776. 

D8.61 TRCRSCTLRn, Resource Selection Control Registers 2-16 on page D8-777. 
D8.62 TRCSEQEVRn, Sequencer State Transition Control Registers 0-2 on page D8-778. 
D8.63 TRCSEORSTEVR, Sequencer Reset Control Register on page D8-780. 
D8&.64 TRCSEQSTR, Sequencer State Register on page D8-781. 

D8.65 TRCSSCCRO, Single-Shot Comparator Control Register 0 on page D8-782. 
D8.66 TRCSSCSRO, Single-Shot Comparator Status Register 0 on page D8-783. 
D8.67 TRCSTALLCTLR, Stall Control Register on page D8-784. 

D&.68 TRCSTATR, Status Register on page D8-785. 

D8.69 TRCSYNCPR, Synchronization Period Register on page D8-786. 

D8.70 TRCTRACEIDR, Trace ID Register on page D8-787. 

D8.71 TRCTSCTLR, Global Timestamp Control Register on page D8-788. 

D8.72 TRCVICTLR, ViewInst Main Control Register on page D8-789. 

D8.73 TRCVHECTLR, ViewInst Include-Exclude Control Register on page D8-791. 
D8.74 TRCVISSCTLR, ViewInst Start-Stop Control Register on page D8-792. 
D8.75 TRCVMIDCVRO, VMID Comparator Value Register 0 on page D8-793. 
D8.76 TRCVMIDCCTLRO, Virtual context identifier Comparator Control Register 0 
on page D8-794. 
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D8 ETM registers 
D8.1 ETM register summary 

















































































































D8.1 ETM register summary 
This section summarizes the ETM trace unit registers. 
All ETM trace unit registers are 32-bit wide. The description of each register includes its offset from a 
base address. The base address is defined by the system integrator when placing the ETM trace unit in 
the Debug-APB memory map. 
The following table lists all of the ETM trace unit registers. 
Table D8-1 ETM trace unit register summary 
Offset Name Type | Reset Description 
@x004 TRCPRGCTLR RW | 0x00000088 | DS.60 TRCPRGCTLR, Programming Control Register on page D8-776 
@x@@C TRCSTATR RO | 0x@00080@3 | DS.68 TRCSTATR, Status Register on page D8-785 
0x010 TRCCONFIGR RW |UNK D8.20 TRCCONFIGR, Trace Configuration Register on page D8-727 
@x018 TRCAUXCTLR RW _ | exeeeeeees | D8.5 TRCAUXCTLRE, Auxiliary Control Register on page D8-709 
@x020 TRCEVENTCTLOR | RW | UNK D8.26 TRCEVENTCTLOR, Event Control 0 Register on page D8-736 
0x024 TRCEVENTCTLIR | RW | UNK D8.27 TRCEVENTCTLIR, Event Control I Register on page D8-738 
@xO2C TRCSTALLCTLR |RW |UNK D8.67 TRCSTALLCTLR, Stall Control Register on page D8-784 
0x030 TRCTSCTLR RW |UNK D8.71 TRCTSCTLR, Global Timestamp Control Register 
on page D8-788 
0x34 TRCSYNCPR RW |UNK D8.69 TRCSYNCPR, Synchronization Period Register on page D8-786 
0x038 TRCCCCTLR RW |UNK D8.7 TRCCCCTLR, Cycle Count Control Register on page D8-712 
@x@3C TRCBBCTLR RW |UNK D8.6 TRCBBCTLR, Branch Broadcast Control Register 
on page D8-711 
@x040 TRCTRACEIDR RW |UNK D8.70 TRCTRACEIDR, Trace ID Register on page D8-787 
0x080 TRCVICTLR RW |UNK D8.72 TRCVICTLR, ViewInst Main Control Register on page D8-789 
0x084 TRCVITECTLR RW |UNK D8.73 TRCVIECTLR, ViewInst Include-Exclude Control Register 
on page D8-791 
Qx088 TRCVISSCTLR RW |UNK D8.74 TRCVISSCTLR, ViewInst Start-Stop Control Register 
on page D8-792 
@x100 TRCSEQEVRO RW |UNK D8.62 TRCSEQEVRn, Sequencer State Transition Control Registers 0-2 
on page D8-778 
0x104 TRCSEQEVRI RW |UNK D8.62 TRCSEQEVRn, Sequencer State Transition Control Registers 0-2 
on page D8-778 
0x108 TRCSEQEVR2 RW |UNK D8.62 TRCSEQEVRn, Sequencer State Transition Control Registers 0-2 
on page D8-778 
@x118 TRCSEQRSTEVR |RW_ |UNK D8.63 TRCSEQRSTEVR, Sequencer Reset Control Register 
on page D8-780 
@x11C TRCSEQSTR RW |UNK D8.64 TRCSEQSTR, Sequencer State Register on page D8-781 
@x120 TRCEXTINSELR | RW |UNK D8.28 TRCEXTINSELR, External Input Select Register 
on page D8-739 
@x140 TRCCNTRLDVRO |RW_ | UNK D8.18 TRCCNTRLDVRn, Counter Reload Value Registers 0-1 
on page D8-725 
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D8 ETM registers 
D8.1 ETM register summary 


Table D8-1 ETM trace unit register summary (continued) 





































































































Offset Name Type | Reset Description 
@x144 TRCCNTRLDVRI |RW_ | UNK D8.18 TRCCNTRLDVRn, Counter Reload Value Registers 0-1 
on page D8-725 
@x150 TRCCNTCTLRO RW |UNK D8.16 TRCCNTCTLRO, Counter Control Register 0 on page D8-721 
@x154 TRCCNTCTLRI1 RW |UNK D8.17 TRCCNTCTLRI, Counter Control Register 1 on page D8-723 
0x160 TRCCNTVRO RW |UNK D8.19 TRCCNTVRn, Counter Value Registers 0-1 on page D8-726 
0x164 TRCCNTVRI RW |UNK D8.19 TRCCNTVRn, Counter Value Registers 0-1 on page D8-726 
@x180 TRCIDR8 RO | gxeeeeeees | 08.35 TRCIDRS, ID Register 8 on page D8-751 
@x184 TRCIDR9 RO | gxeeeeeees | 08.36 TRCIDRY, ID Register 9 on page D8-752 
@x188 TRCIDR10 RO | gxeeee9ee9es | 28.37 TRCIDR1O, ID Register 10 on page D8-753 
@x18C TRCIDR11 RO | exeeeeeees | 08.38 TRCIDRII, ID Register 1] on page D8-754 
@x190 TRCIDR12 RO | gxeeeeeeee | 08.39 TRCIDR12, ID Register 12 on page D8-755 
@x194 TRCIDR13 RO | @xeeee0e9es | 08.40 TRCIDR13, ID Register 13 on page D8-756 
@x1Ce TRCIMSPECO RW | exeeeeeees | D8.4/ TRCIMSPECO, IMPLEMENTATION SPECIFIC Register 0 
on page D8-757 
@x1E@ TRCIDRO RO | g@x28ee@eEA1 | D8.29 TRCIDRO, ID Register 0 on page D8-740 
@x1E4 TRCIDR1 RO | 9@x41901422 | D8.30 TRCIDRI, ID Register ] on page D8-742 
@x1E8 TRCIDR2 RO | @x2e001048 | D8.3/ TRCIDR2, ID Register 2 on page D8-743 
@x1EC TRCIDR3 RO | @xep7Beee4 | D8.32 TRCIDR3, ID Register 3 on page D8-745 
@x1F@ TRCIDR4 RO | @x111700e4 | D8.33 TRCIDR4, ID Register 4 on page D8-747 
@x1F4 TRCIDRS RO | 9x2883842F | D8.34 TRCIDRS, ID Register 5 on page D8-749 
@x200 TRCRSCTLRn RW |UNK D8.61 TRCRSCTLRn, Resource Selection Control Registers 2-16 
on page D8-777, n is 2, 15 
Qx280 TRCSSCCRO RW |UNK D8.65 TRCSSCCRO, Single-Shot Comparator Control Register 0 
on page D8-782 
@x2A0 TRCSSCSRO RW |UNK D8.66 TRCSSCSRO, Single-Shot Comparator Status Register 0 
on page D8-783 
0x300 TRCOSLAR WO _ | 0x00000001 | D8.50 TRCOSLAR, OS Lock Access Register on page D8-766 
0x304 TRCOSLSR RO | 0@x@@000@@QA | D8.57 TRCOSLSR, OS Lock Status Register on page D8-767 
@x310 TRCPDCR RW _| 0x@0@00008O | D8.52 TRCPDCR, Power Down Control Register on page D8-768 
@x314 TRCPDSR RO | 0x@0000013 | D3S.53 TRCPDSR, Power Down Status Register on page D8-769 
0x400 TRCACVRn RW |UNK D8.3 TRCACVRn, Address Comparator Value Registers 0-7 











on page D8-707 
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D8-702 


D8 ETM registers 
D8.1 ETM register summary 


Table D8-1 ETM trace unit register summary (continued) 














































































































Offset Name Type | Reset Description 
0x480 TRCACATRn RW |UNK D8.2 TRCACATRn, Address Comparator Access Type Registers 0-7 
on page D8-705 
@x600 TRCCIDCVRO RW |UNK D8.9 TRCCIDCVRO, Context ID Comparator Value Register 0 
on page D8-714 
@x640 TRCVMIDCVRO RW |UNK D8.75 TRCVMIDCVRO, VMID Comparator Value Register 0 
on page D8-793 
Qx680 TRCCIDCCTLRO |RW |UNK D8.8 TRCCIDCCTLRO, Context ID Comparator Control Register 0 
on page D8-713 
0x688 TRCVMIDCCTRLO | RW | UNK D8.76 TRCVMIDCCTLRO, Virtual context identifier Comparator 
Control Register 0 on page D8-794 
@xEE4 TRCITATBIDR RW |UNK D8.42 TRCITATBIDR, Integration ATB Identification Register 
on page D8-758 
@xEEC TRCITIDATAR WO |UNK D8.46 TRCITIDATAR, Integration Instruction ATB Data Register 
on page D8-762 
OxEF4 TRCITIATBINR RO |UNK D8.44 TRCITIATBINR, Integration Instruction ATB In Register 
on page D8-760 
OxEFC TRCITIATBOUTR | WO |UNK D8.45 TRCITIATBOUTR, Integration Instruction ATB Out Register 
on page D8-761 
OxFeO TRCITCTRL RW _ | exeeeeeeas | D8.43 TRCITCTRL, Integration Mode Control Register 
on page D8-759 
OxFA@ TRCCLAIMSET RW |UNK D8.15 TRCCLAIMSET, Claim Tag Set Register on page D8-720 
@xFA4 TRCCLAIMCLR RW _ | exeeeeeeas | D3.14 TRCCLAIMCLR, Claim Tag Clear Register on page D8-719 
OxFA8 TRCDEVAFFO RO |UNK D8.21 TRCDEVAFFO, Device Affinity Register 0 on page D8-730 
@xFAC TRCDEVAFF1 RO |UNK D8.22 TRCDEVAFF'1, Device Affinity Register 1 on page D8-732 
OxFBO TRCLAR WO |UNK D8.47 TRCLAR, Software Lock Access Register on page D8-763 
OxFB4 TRCLSR RO | 0x00000088 | DS.45 TRCLSR, Software Lock Status Register on page D8-764 
OxFB8 TRCAUTHSTATUS |RO- | UNK D8.4 TRCAUTHSTATUS, Authentication Status Register 
on page D8-708 
@xFBC TRCDEVARCH RO | 0x47724A13 | D8.23 TRCDEVARCH, Device Architecture Register on page D8-733 
@xFC8 TRCDEVID RO | @xeeee0ee9ed | 08.24 TRCDEVID, Device ID Register on page D8-734 
@xFCC TRCDEVTYPE RO | 0x@0000013 | D8.25 TRCDEVTYPE, Device Type Register on page D8-735 
@xFE@ TRCPIDRO RO_ | exeeeeeeaa | D8.54 TRCPIDRO, ETM Peripheral Identification Register 0 
on page D8-770 
@xFE4 TRCPIDRI1 RO _ | gxeeeeeepp | DS.55 TRCPIDRI, ETM Peripheral Identification Register 1 
on page D8-771 
@xFE8 TRCPIDR2 RO _ | @xeeeeee2B | D8.56 TRCPIDR2, ETM Peripheral Identification Register 2 
on page D8-772 
@xFEC TRCPIDR3 RO _ | exeeeeeeeas | D8.57 TRCPIDR3, ETM Peripheral Identification Register 3 














on page D8-773 
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D8-703 


D8 ETM registers 
D8.1 ETM register summary 


Table D8-1 ETM trace unit register summary (continued) 


























Offset Name Type | Reset Description 

@xFD@ TRCPIDR4 RO _ | exeeee0eees | D8.58 TRCPIDR4, ETM Peripheral Identification Register 4 
on page D8-774 

@xFD4-@xFDC | TRCPIDRn RO | 0x000000@8 | D8.59 TRCPIDRn, ETM Peripheral Identification Registers 5-7 
on page D8-775 

OxFFO TRCCIDRO RO _ | @xeeeeee0en | DS.10 TRCCIDRO, ETM Component Identification Register 0 
on page D8-715 

OxFF4 TRCCIDR1 RO | exeeeeeege | D8.17 TRCCIDRI, ETM Component Identification Register 1 
on page D8-716 

OxFF8 TRCCIDR2 RO_ | exeeee0ees | D8.12 TRCCIDR2, ETM Component Identification Register 2 
on page D8-717 

@xFFC TRCCIDR3 RO_ | gxeeeee0esi | D8.13 TRCCIDR3, ETM Component Identification Register 3 











on page D8-718 
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D8 ETM registers 
D8.2 TRCACATRn, Address Comparator Access Type Registers 0-7 


D8.2 TRCACATRn, Address Comparator Access Type Registers 0-7 
The TRCACATRn control the access for the corresponding address comparators. 


Bit field descriptions 
The TRCACATRn is a 64-bit register. 


63 1615 12 11 8 7 3.2 10 


EXLEVEL_NS— CONTEXTTYPE— 
RESO EXLEVEL_S 


Figure D8-1 TRCACATRnh bit assignments 
RESO, [63:16] 
RESO Reserved. 
EXLEVEL _NS, [15:12] 


Each bit controls whether a comparison can occur in Non-secure state for the corresponding 
Exception level. The possible values are: 


7) The trace unit can perform a comparison, in Non-secure state, for Exception level n. 
1 The trace unit does not perform a comparison, in Non-secure state, for Exception level 
n. 


The Exception levels are: 
Bit[12] Exception level 0. 
Bit[13] Exception level 1. 
Bit[14] Exception level 2. 
Bit[15] Always REso. 


EXLEVEL 5S, [11:8] 


Each bit controls whether a comparison can occur in Secure state for the corresponding 
Exception level. The possible values are: 


7) The trace unit can perform a comparison, in Secure state, for Exception level n. 
1 The trace unit does not perform a comparison, in Secure state, for Exception level n. 
The Exception levels are: 
Bit[8] | Exception level 0. 
Bit[9]__ Exception level 1. 
Bit[10] Always REso. 
Bit[11] Exception level 3. 
RESO, [7:4] 
RESO Reserved. 
CONTEXT TYPE, [3:2] 


Controls whether the trace unit performs a Context ID comparison, a VMID comparison, or both 
comparisons: 
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@bee 
@be1 


@b10 


@b11 


TYPE, [1:0] 


D8 ETM registers 
D8.2 TRCACATRn, Address Comparator Access Type Registers 0-7 


The trace unit does not perform a Context ID comparison. 


The trace unit performs a Context ID comparison using the Context ID comparator 
that the CONTEXT field specifies, and signals a match if both the Context ID 
comparator matches and the address comparator match. 


The trace unit performs a VMID comparison using the VMID comparator that the 
CONTEXT field specifies, and signals a match if both the VMID comparator and the 
address comparator match. 


The trace unit performs a Context ID comparison and a VMID comparison using the 
comparators that the CONTEXT field specifies, and signals a match if the Context ID 
comparator matches, the VMID comparator matches, and the address comparator 
matches. 


Type of comparison: 


@bee 


Instruction address, RESO. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCACATR=a can be accessed through the external debug interface, offset 0x480-0x4B8. 





100442 _0200_00_en 


Copyright © 2016-2018 Arm Limited or its affiliates. All rights D8-706 
reserved. 
Non-Confidential 


D8 ETM registers 
D8.3 TRCACVRn, Address Comparator Value Registers 0-7 


D8.3 TRCACVRn, Address Comparator Value Registers 0-7 
The TRCACVRn indicate the address for the address comparators. 


Bit field descriptions 
The TRCACVRnh is a 64-bit register. 


63 0 


ADDRESS 


Figure D8-2 TRCACVRnh bit assignments 


ADDRESS, [63:0] 
The address value to compare against. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCACVRn can be accessed through the external debug interface, offset @x4@0-0x43C. 
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D8 ETM registers 
D8.4 TRCAUTHSTATUS, Authentication Status Register 


D8.4 TRCAUTHSTATUS, Authentication Status Register 
The TRCAUTHSTATUS indicates the current level of tracing permitted by the system. 


Bit field descriptions 
The TRCAUTHSTATUS is a 64-bit register. 


31 876543210 


RESO SNID 
SID 
NSNID 


NSID 


Figure D8-3 TRCAUTHSTATUS bit assignments 

RESO, [31:8] 

RESO Reserved. 
SNID, [7:6] 

Secure Non-invasive Debug: 

@b1@ Secure Non-invasive Debug implemented but disabled. 

@b11 Secure Non-invasive Debug implemented and enabled. 
SID, [5:4] 

Secure Invasive Debug: 


@bee = Secure Invasive Debug is not implemented. 


NSNID, [3:2] 
Non-secure Non-invasive Debug: 
@b1@ Non-secure Non-invasive Debug implemented but disabled, NIDEN=0. 
@b11 Non-secure Non-invasive Debug implemented and enabled, NIDEN=1. 
NSID, [1:0] 
Non-secure Invasive Debug: 


@bee@ =Non-secure Invasive Debug is not implemented. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCAUTHSTATUS can be accessed through the external debug interface, offset @xFB8. 
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D8 ETM registers 
D8.5 TRCAUXCTLR, Auxiliary Control Register 


D8.5 TRCAUXCTLR, Auxiliary Control Register 


The TRCAUXCTLR provides IMPLEMENTATION DEFINED configuration and control options. 


Bit field descriptions 
The TRCAUXCTLR is a 32-bit register. 


31 876543210 


RESO COREIFEN | 
AUTHNOFLUSH 


TSNODELAY 
SYNCDELAY 
OVFLW 
IDLEACK 
AFREADY 

















Figure D8-4 TRCAUXCTLR bit assignments 
RESO, [31:8] 
RESO Reserved. 
COREIFEN, [7] 


Keep core interface enabled regardless of trace enable register state. The possible values are: 


7) Core interface enabled is set by trace enable register state. 
1 Enable core interface, regardless of trace enable register state. 
RESO, [6] 


RESO Reserved. 


AUTHNOFLUSH, [5] 


Do not flush trace on de-assertion of authentication inputs. The possible values are: 


e ETM trace unit FIFO is flushed and ETM trace unit enters idle state when DBGEN or 
NIDEN is LOW. 

1 ETM trace unit FIFO is not flushed and ETM trace unit does not enter idle state when 
DBGEN or NIDEN is LOW. 


When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 
TSNODELAY, [4] 

Do not delay timestamp insertion based on FIFO depth. The possible values are: 

7) Timestamp packets are inserted into FIFO only when trace activity is LOW. 

1 Timestamp packets are inserted into FIFO irrespective of trace activity. 
SYNCDELAY, [3] 


Delay periodic synchronization if FIFO is more than half-full. The possible values are: 





7) SYNC packets are inserted into FIFO only when trace activity is low. 
1 SYNC packets are inserted into FIFO irrespective of trace activity. 
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D8 ETM registers 
D8.5 TRCAUXCTLR, Auxiliary Control Register 


OVFLW, [2] 


Force overflow if synchronization is not completed when second synchronization becomes due. 
The possible values are: 


) No FIFO overflow when SYNC packets are delayed. 
1 Forces FIFO overflow when SYNC packets are delayed. 


When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 
IDLEACK, [1] 


Force idle-drain acknowledge high, CPU does not wait for trace to drain before entering WFX 
state. The possible values are: 


7) ETM trace unit idle acknowledge is asserted only when the ETM trace unit is in idle 
State. 

1 ETM trace unit idle acknowledge is asserted irrespective of the ETM trace unit idle 
State. 


When this bit is set to 1, trace unit behavior deviates from architecturally-specified behavior. 
AFREADY, [0] 


Always respond to AFREADY immediately. Does not have any interaction with FIFO draining, 
even in WFI state. The possible values are: 


7) ETM trace unit AFREADYM output is asserted only when the ETM trace unit is in 
idle state or when all the trace bytes in FIFO before a flush request are output. 
1 ETM trace unit AFREADYM output is always asserted HIGH. When this bit is set to 


1, trace unit behavior deviates from architecturally-specified behavior. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCAUXCTLR can be accessed through the external debug interface, offset 0x018. 
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D8 ETM registers 
D8.6 TRCBBCTLR, Branch Broadcast Control Register 


D8.6 TRCBBCTLR, Branch Broadcast Control Register 


The TRCBBCTLR controls how branch broadcasting behaves, and allows branch broadcasting to be 
enabled for certain memory regions. 


Bit field descriptions 
The TRCAUXCTLR is a 32-bit register. 


31 987 0 
L_MODE 
RESO 


Figure D8-5 TRCBBCTLR bit assignments 
RESO, [31:9] 


RESO Reserved. 


MODE, [8] 
Mode bit: 
7) Exclude mode. Branch broadcasting is not enabled in the address range that RANGE 
defines. 
If RANGE==0 then branch broadcasting is enabled for the entire memory map. 
1 Include mode. Branch broadcasting is enabled in the address range that RANGE 
defines. 
If RANGE==0 then the behavior of the trace unit is CONSTRAINED UNPREDICTABLE. That 
is, the trace unit might or might not consider any instructions to be in a branch 
broadcast region. 
RANGE, [7:0] 


Address range field. 


Selects which address range comparator pairs are in use with branch broadcasting. Each bit 
represents an address range comparator pair, so bit[n] controls the selection of address range 
comparator pair n. If bit[n] is: 

@ The address range that address range comparator pair n defines, is not selected. 

1 The address range that address range comparator pair n defines, is selected. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCBBCTLR can be accessed through the external debug interface, offset @x@3C. 
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D8 ETM registers 
D8.7 TRCCCCTLR, Cycle Count Control Register 


D8.7 TRCCCCTLR, Cycle Count Control Register 
The TRCCCCTLR sets the threshold value for cycle counting. 


Bit field descriptions 
The TRCCCCTLR is a 32-bit register. 


31 12 11 0 


RESO 


Figure D8-6 TRCCCCTLR bit assignments 
RESO, [31:12] 


RESO Reserved. 


THRESHOLD, [11:0] 
Instruction trace cycle count threshold. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCCCCTLR can be accessed through the external debug interface, offset @x@38. 
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D8 ETM registers 
D8.8 TRCCIDCCTLRO, Context ID Comparator Control Register 0 


D8.8 TRCCIDCCTLRO, Context ID Comparator Control Register 0 
The TRCCIDCCTLR0O controls the mask value for the context ID comparators. 


Bit field descriptions 
The TRCCIDCCTLR0O is a 32-bit register. 


31 4 3 0 


RESO 


Figure D8-7 TRCCIDCCTLRO bit assignments 
RESO, [31:4] 
RESO Reserved. 
COMP), [3:0] 


Controls the mask value that the trace unit applies to TRCCIDCVRO. Each bit in this field 
corresponds to a byte in TRCCIDCVRO. When a bit is: 


7) The trace unit includes the relevant byte in TRCCIDCVRO when it performs the 
Context ID comparison. 
1 The trace unit ignores the relevant byte in TRCCIDCVRO when it performs the 


Context ID comparison. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCIDCCTLRO can be accessed through the external debug interface, offset @x680. 
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D8 ETM registers 
D8.9 TRCCIDCVRO, Context ID Comparator Value Register 0 


D8.9 TRCCIDCVRO, Context ID Comparator Value Register 0 
The TRCCIDCVRO contains a Context ID value. 


Bit field descriptions 
The TRCCIDCVR0O is a 64-bit register. 


63 32 31 0 


Value 


Figure D8-8 TRCCIDCVRO bit assignments 


RESO 


RESO, [63:32] 


RESO Reserved. 


VALUE, [31:0] 


The data value to compare against. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCIDCVRO can be accessed through the external debug interface, offset @x60ee. 
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D8 ETM registers 
D8.10 TRCCIDRO, ETM Component Identification Register 0 


D8.10 TRCCIDRO, ETM Component Identification Register 0 
The TRCCIDRO provides information to identify a trace component. 


Bit field descriptions 
The TRCCIDR0O is a 32-bit register. 


31 8 7 0 


RESO 


Figure D8-9 TRCCIDRO bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL_ 0, [7:0] 
@x@D Preamble byte 0. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCIDRO can be accessed through the external debug interface, offset @xFFO. 
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D8 ETM registers 
D8.11 TRCCIDR1, ETM Component Identification Register 1 


D8.11 TRCCIDR1, ETM Component Identification Register 1 


The TRCCIDR1 provides information to identify a trace component. 


Bit field descriptions 
The TRCCIDR1 is a 32-bit register. 


31 8 7 4 3 0 
RESO 


Figure D8-10 TRCCIDR1 bit assignments 
RESO, [31:8] 
RESO Reserved. 
CLASS, [7:4] 
@x9 Debug component. 
PRMBL._1, [3:0] 
@x® Preamble byte 1. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCCIDRI can be accessed through the external debug interface, offset @xFF4. 
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D8 ETM registers 
D8.12 TRCCIDR2, ETM Component Identification Register 2 


D8.12 TRCCIDR2, ETM Component Identification Register 2 
The TRCCIDR2 provides information to identify a CTI component. 


Bit field descriptions 
The TRCCIDR2 is a 32-bit register. 


31 8 7 0 


RESO 


Figure D8-11 TRCCIDR2 bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL 2, [7:0] 
@x@5 ~~ Preamble byte 2. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCIDR2 can be accessed through the external debug interface, offset @xFF8. 
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D8 ETM registers 
D8.13 TRCCIDR3, ETM Component Identification Register 3 


D8.13 TRCCIDR3, ETM Component Identification Register 3 
The TRCCIDR3 provides information to identify a trace component. 


Bit field descriptions 
The TRCCIDR3 is a 32-bit register. 


31 8 7 0 


RESO 


Figure D8-12 TRCCIDR3 bit assignments 
RESO, [31:8] 
RESO Reserved. 
PRMBL_ 3, [7:0] 
@xB1 Preamble byte 3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCIDR3 can be accessed through the external debug interface, offset @xFFC. 
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D8 ETM registers 
D8.14 TRCCLAIMCLR, Claim Tag Clear Register 


D8.14 TRCCLAIMCLR, Claim Tag Clear Register 
The TRCCLAIMCLR clears bits in the claim tag and determines the current value of the claim tag. 


Bit field descriptions 
The TRCCLAIMCLR is a 32-bit register. 


Figure D8-13 TRCCLAIMCLR bit assignments 
RESO, [31:4] 


RESO Reserved. 


CLR, [3:0] 
On reads, for each bit: 
) Claim tag bit is not set. 
1 Claim tag bit is set. 


On writes, for each bit: 
(4) Has no effect. 
1 Clears the relevant bit of the claim tag. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCLAIMCLR can be accessed through the external debug interface, offset @xFA4. 
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D8 ETM registers 
D8.15 TRCCLAIMSET, Claim Tag Set Register 


D8.15 TRCCLAIMSET, Claim Tag Set Register 
The TRCCLAIMSET sets bits in the claim tag and determines the number of claim tag bits implemented. 


Bit field descriptions 
The TRCCLAIMSET is a 32-bit register. 


Figure D8-14 TRCCLAIMSET bit assignments 
RESO, [31:4] 


RESO Reserved. 


SET, [3:0] 
On reads, for each bit: 
@ Claim tag bit is not implemented. 
1 Claim tag bit is implemented. 


On writes, for each bit: 
(4) Has no effect. 
1 Sets the relevant bit of the claim tag. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCLAIMSET can be accessed through the external debug interface, offset @xFA@. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D8-720 
reserved. 
Non-Confidential 


D8 ETM registers 
D8.16 TRCCNTCTLRO, Counter Control Register 0 


D8.16 TRCCNTCTLRO, Counter Control Register 0 
The TRCCNTCTLRO controls the counter. 


Bit field descriptions 
The TRCCNTCTLRO is a 32-bit register. 


31 17161514 1211 87 6 
BEDSEL CNTTYPE— 
RESO Se eiegle 


Figure D8-15 TRCCNTCTLRO bit assignments 
RESO, [31:17] 
RESO Reserved. 
RLDSELF, [16] 


Defines whether the counter reloads when it reaches zero: 


) The counter does not reload when it reaches zero. The counter only reloads based on 
RLDTYPE and RLDSEL. 
1 The counter reloads when it reaches zero and the resource selected by CNTTYPE and 


CNTSEL is also active. The counter also reloads based on RLDTYPE and RLDSEL. 


RLDTYPE, [15] 
Selects the resource type for the reload: 
i) Single selected resource. 
1 Boolean combined resource pair. 
RESO, [14:12] 
RESO Reserved. 
RLDSEL, [11:8] 
Selects the resource number, based on the value of RLDTYPE: 
When RLDTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When RLDTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
CNTTYPE, [7] 


Selects the resource type for the counter: 


7) Single selected resource. 
1 Boolean combined resource pair. 
RESO, [6:4] 


RESO Reserved. 
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D8 ETM registers 
D8.16 TRCCNTCTLRO, Counter Control Register 0 


CNTSEL, [3:0] 
Selects the resource number, based on the value of CNT TYPE: 
When CNTTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When CNTTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCCNTCTLRO can be accessed through the external debug interface, offset @x159. 
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D8 ETM registers 
D8.17 TRCCNTCTLR1, Counter Control Register 1 


D8.17 TRCCNTCTLR1, Counter Control Register 1 
The TRCCNTCTLRI1 controls the counter. 


Bit field descriptions 
The TRCCNTCTLRI is a 32-bit register. 


31 1817161514 1211 8 7 6 


eNnCHAI = CNTTYPE— 
RESO Ri aa 
RLDTYPE 


Figure D8-16 TRCCNTCTLR1 bit assignments 
RESO, [31:18] 
RESO Reserved. 
CNTCHAIN, [17] 


Defines whether the counter decrements when the counter reloads. This enables two counters to 
be used in combination to provide a larger counter: 


7) The counter operates independently from the counter. The counter only decrements 
based on CNTTYPE and CNTSEL. 
1 The counter decrements when the counter reloads. The counter also decrements when 


the resource selected by CNTTYPE and CNTSEL is active. 


RLDSELE, [16] 


Defines whether the counter reloads when it reaches zero: 


) The counter does not reload when it reaches zero. The counter only reloads based on 
RLDTYPE and RLDSEL. 
1 The counter reloads when it is zero and the resource selected by CNTTYPE and 


CNTSEL is also active. The counter also reloads based on RLDTYPE and RLDSEL. 


RLDTYPE, [15] 
Selects the resource type for the reload: 


@ Single selected resource. 


1 Boolean combined resource pair. 


RESO, [14:12] 

RESO Reserved. 
RLDSEL, [11:8] 

Selects the resource number, based on the value of RLDTYPE: 

When RLDTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 

When RLDTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
CNTTYPE, [7] 


Selects the resource type for the counter: 
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D8 ETM registers 
D8.17 TRCCNTCTLR1, Counter Control Register 1 


7) Single selected resource. 
1 Boolean combined resource pair. 
RESO, [6:4] 


RESO Reserved. 


CNTSEL, [3:0] 
Selects the resource number, based on the value of CNT TYPE: 
When CNTTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When CNTTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCCNTCTLRI can be accessed through the external debug interface, offset @x154. 
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D8 ETM registers 
D8.18 TRCCNTRLDVRn, Counter Reload Value Registers 0-1 


D8.18 TRCCNTRLDVRn, Counter Reload Value Registers 0-1 
The TRCCNTRLDVRn define the reload value for the counter. 


Bit field descriptions 
The TRCCNTRLDVRn is a 32-bit register. 


31 1615 0 


VALUE 


RESO 





Figure D8-17 TRCCNTRLDVRno bit assignments 
RESO, [31:16] 
RESO Reserved. 
VALUE, [15:0] 


Defines the reload value for the counter. This value is loaded into the counter each time the 
reload event occurs. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCCNTRLDVRn registers can be accessed through the external debug interface, offsets: 


TRCCNTRLDVRO 
6x14@. 


TRCCNTRLDVRI 
6x144. 
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D8 ETM registers 
D8.19 TRCCNTVRn, Counter Value Registers 0-1 


D8.19 TRCCNTVRn, Counter Value Registers 0-1 


The TRCCNTVRn contain the current counter value. 


Bit field descriptions 
The TRCCNTVRn is a 32-bit register. 


31 1615 0 


VALUE 


RESO 





Figure D8-18 TRCCNTVRn bit assignments 


RESO, [31:16] 


RESO Reserved. 


VALUE, [15:0] 
Contains the current counter value. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCNTRLDVRn registers can be accessed through the external debug interface, offsets: 


TRCCNTVRO 
6x16. 


TRCCNTVRI 
6x164. 
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D8 ETM registers 
D8.20 TRCCONFIGR, Trace Configuration Register 


D8.20 TRCCONFIGR, Trace Configuration Register 
The TRCCONFIGR controls the tracing options. 


Bit field descriptions 
The TRCCONFIGR is a 32-bit register. 


18 17 1615 1413 1211 10 876543210 





pv VMID — 
RES1 DA CID 
RESO VMIDOPT CCl 


RS BB 
TS INSTPO 





Figure D8-19 TRCCONFIGR bit assignments 
RESO, [31:18] 


RESO Reserved. 


DV, [17] 
Enables data value tracing. The possible values are: 
() Disables data value tracing. 
1 Enables data value tracing. 

DA, [16] 
Enables data address tracing. The possible values are: 
) Disables data address tracing. 
1 Enables data address tracing. 


VMIDOPT, [15] 


Configures the Virtual context identifier value used by the trace unit, both for trace generation 
and in the Virtual context identifier comparators. The possible values are: 


@be VTTBR_EL2.VMID is used. If the trace unit supports a Virtual context identifier 
larger than the VTTBR_EL2.VMID, the upper unused bits are always zero. If the trace 
unit supports a Virtual context identifier larger than 8 bits and if the VTCR_EL2.VS 
bit forces use of an 8-bit Virtual context identifier, bits [15:8] of the trace unit Virtual 
context identifier are always zero. 


@b1 CONTEXTIDR_EL2 is used. TRCIDR2.VMIDOPT indicates whether this field is 
implemented. 
QE, [14:13] 
Enables Q element. The possible values are: 


@bee@ Qelements are disabled. 


@b@1 Q elements with instruction counts are disabled. Q elements without instruction counts 
are disabled. 


@b10 ~— Reserved. 


@b11 Qelements with and without instruction counts are enabled. 
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RS, [12] 


TS, [11] 


D8 ETM registers 
D8.20 TRCCONFIGR, Trace Configuration Register 


Enables the return stack. The possible values are: 

@ Disables the return stack. 

1 Enables the return stack. 

Enables global timestamp tracing. The possible values are: 
7) Disables global timestamp tracing. 

1 Enables global timestamp tracing. 


COND, [10:8] 


Enables conditional instruction tracing. The possible values are: 


@beee Conditional instruction tracing is disabled. 

@be@01 Conditional load instructions are traced. 

@be@1@ Conditional store instructions are traced. 

@b@11 Conditional load and store instructions are traced. 


@b111 All conditional instructions are traced. 


VMID, [7] 
Enables VMID tracing. The possible values are: 
() Disables VMID tracing. 
1 Enables VMID tracing. 
CID, [6] 
Enables context ID tracing. The possible values are: 
() Disables context ID tracing. 
1 Enables context ID tracing. 
RESO, [5] 


CCL, [4] 


BB, [3] 


RESO Reserved. 


Enables cycle counting instruction trace. The possible values are: 
7) Disables cycle counting instruction trace. 
1 Enables cycle counting instruction trace. 


Enables branch broadcast mode. The possible values are: 


(7) Disables branch broadcast mode. 


1 Enables branch broadcast mode. 


INSTPO, [2:1] 


Controls whether load and store instructions are traced as PO instructions. The possible values 
are: 


@bee ~— Load and store instructions are not traced as PO instructions. 


@b@1 ~—Load instructions are traced as PO instructions. 
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D8 ETM registers 
D8.20 TRCCONFIGR, Trace Configuration Register 


@b10 Store instructions are traced as PO instructions. 
@b11 Load and store instructions are traced as PO instructions. 


RESI, [0] 


RES1 Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCCONFIGR can be accessed through the external debug interface, offset @x@10. 
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D8 ETM registers 
D8.21 TRCDEVAFFO, Device Affinity Register 0 


D8.21 TRCDEVAFFO, Device Affinity Register 0 


The TRCDEVAFFO0 provides an additional core identification mechanism for scheduling purposes in a 
cluster. TRCDEVAFFO is a read-only copy of MPIDR accessible from the external debug interface. 


Bit field descriptions 
The TRCDEVAFFO is a 32-bit register. 


31 30 29 25 24 23 16.15 8 7 0 
mT — 
RES1 
RESO 


Figure D8-20 TRCDEVAFFO bit assignments 
RES1, [31] 
RESI Reserved. 
U, [30] 
Indicates a single core system, as distinct from core 0 in a cluster. This value is: 


7) Core is part of a multiprocessor system. This is the value for implementations with 
more than one core, and for implementations with an ACE or CHI master interface. 


1 Core is part of a uniprocessor system. This is the value for single core 
implementations with an AXI master interface. 


RESO, [29:25] 
RESO Reserved. 
MT, [24] 


Indicates whether the lowest level of affinity consists of logical cores that are implemented 
using a multithreading type approach. This value is: 


() Performance of cores at the lowest affinity level is largely independent. 
Aff2, [23:16] 

Affinity level 2. Second highest level affinity field. 

Indicates the value read in the CLUSTERIDAFF2 configuration signal. 
Aff1, [15:8] 

Affinity level 1. Third highest level affinity field. 

Indicates the value read in the CLUSTERIDAFF1 configuration signal. 
Aff0, [7:0] 

Affinity level 0. Lowest level affinity field. 


Indicates the core number in the Cortex-A55 core. The possible values are: 





@xe A cluster with one core only. 
@x®, @x1 A cluster with two cores. 
@x®, @x1, @x2 A cluster with three cores. 
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D8 ETM registers 
D8.21 TRCDEVAFFO, Device Affinity Register 0 


@x®, @x1, @x2, @x3 A cluster with four cores. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCDEVAFFO0 can be accessed through the external debug interface, offset @xFA8. 
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D8 ETM registers 
D8.22 TRCDEVAFF1, Device Affinity Register 1 


D8.22 TRCDEVAFF1, Device Affinity Register 1 


The TRCDEVAFF1 is a read-only copy of MPIDR_EL1[63:32] as seen from EL3, unaffected by 
VMPIDR EL2. 
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D8 ETM registers 
D8.23 TRCDEVARCH, Device Architecture Register 


TRCDEVARCH, Device Architecture Register 


The TRCDEVARCH identifies the ETM trace unit as an ETMv4 component. 


Bit field descriptions 
The TRCDEVARCH is a 32-bit register. 
31 21 2019 16:15 


0 


ARCHITECT i REVISION ARCHID 


PRESENT! 


Figure D8-21 TRCDEVARCH bit assignments 


ARCHITECT, [31:21] 

Defines the architect of the component: 

x4 Arm JEP continuation. 

@x3B Arm JEP 106 code. 
PRESENT, [20] 

Indicates the presence of this register: 

@b1 Register is present. 
REVISION, [19:16] 

Architecture revision: 

@xe2 ~=©Architecture revision 2. 
ARCHID, [15:0] 

Architecture ID: 


@x4A13 ETMv4 component. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCDEVARCH can be accessed through the external debug interface, offset @xFBC. 
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D8 ETM registers 
D8.24 TRCDEVID, Device ID Register 


D8.24  TRCDEVID, Device ID Register 
The TRCDEVID indicates the capabilities of the ETM trace unit. 


Bit field descriptions 
The TRCDEVID is a 32-bit register. 


31 0 


DEVID 


Figure D8-22 TRCDEVID bit assignments 


DEVID, [31:0] 
RAZ. There are no component-defined capabilities. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCDEVID can be accessed through the external debug interface, offset @xFC8. 
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D8 ETM registers 
D8.25 TRCDEVTYPE, Device Type Register 


TRCDEVTYPE, Device Type Register 


The TRCDEVTYPE indicates the type of the component. 


Bit field descriptions 
The TRCDEVTYPE is a 32-bit register. 


31 8 7 4 3 0 


RESO 


Figure D8-23 TRCDEVTYPE bit assignments 

RESO, [31:8] 

RESO Reserved. 
SUB, [7:4] 

The sub-type of the component: 

@beee1 Core trace. 
MAJOR, [3:0] 

The main type of the component: 


@be@0@11 Trace source. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCDEVTYPE can be accessed through the external debug interface, offset @xFCC. 
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D8 ETM registers 
D8.26 TRCEVENTCTLOR, Event Control 0 Register 


D8.26 TRCEVENTCTLOR, Event Control 0 Register 


The TRCEVENTCTLOR controls the tracing of events in the trace stream. The events also drive the 
external outputs from the ETM trace unit. The events are selected from the Resource Selectors. 


Bit field descriptions 
The TRCEVENTCTLOR is a 32-bit register. 


3130 2827 242322 2019 161514 1211 8 7 6 4 3 0 





L_TYPE3 TYPE2— TYPE1 —! TYPEO —! 


RESO 


Figure D8-24 TRCEVENTCTLOR bit assignments 

TYPE3, [31] 

Selects the resource type for trace event 3: 

) Single selected resource. 

1 Boolean combined resource pair. 
RESO, [30:28] 

RESO Reserved. 
SEL3, [27:24] 

Selects the resource number, based on the value of TYPE3: 

When TYPE3 is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 

When TYPE3 is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
TYPE2, [23] 

Selects the resource type for trace event 2: 

7) Single selected resource. 

1 Boolean combined resource pair. 
RESO, [22:20] 

RESO Reserved. 
SEL2, [19:16] 

Selects the resource number, based on the value of TYPE2: 

When TYPE2 is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 

When TYPE2 is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
TYPE1, [15] 

Selects the resource type for trace event 1: 

) Single selected resource. 


1 Boolean combined resource pair. 


RESO, [14:12] 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D8-736 
reserved. 
Non-Confidential 


D8 ETM registers 
D8.26 TRCEVENTCTLOR, Event Control 0 Register 


RESO Reserved. 
SEL1, [11:8] 
Selects the resource number, based on the value of TYPE1: 
When TYPE] is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE] is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


TYPEO, [7] 
Selects the resource type for trace event 0: 
7) Single selected resource. 
1 Boolean combined resource pair. 
RESO, [6:4] 


RESO Reserved. 
SELO, [3:0] 
Selects the resource number, based on the value of TYPEO: 
When TYPEO is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPEO is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCEVENTCTLOR can be accessed through the external debug interface, offset @x@2e. 
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D8 ETM registers 
D8.27 TRCEVENTCTL1R, Event Control 1 Register 


D8.27  TRCEVENTCTL1R, Event Control 1 Register 
The TRCEVENTCTLIR controls the behavior of the events that TRCEVENTCTLOR selects. 


Bit field descriptions 
The TRCEVENTCTLIR is a 32-bit register. 


31 131211 10 8 7 5 4 3 0 
RESO ATB 
LPOVERRIDE 


Figure D8-25 TRCEVENTCTL1R bit assignments 
RESO, [31:13] 
RESO Reserved. 
LPOVERRIDE, [12] 
Low-power state behavior override: 


7) Low-power state behavior unaffected. 


1 Low-power state behavior overridden. The resources and Event trace generation are 
unaffected by entry to a low-power state. 


ATB, [11] 
ATB trigger enable: 
) ATB trigger disabled. 
1 ATB trigger enabled. 
RESO, [10:4] 


RESO Reserved. 
EN, [3:0] 


One bit per event, to enable generation of an event element in the instruction trace stream when 
the selected event occurs: 


e Event does not cause an event element. 


alt Event causes an event element. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCEVENTCTLIR can be accessed through the external debug interface, offset @xe24. 
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D8 ETM registers 
D8.28 TRCEXTINSELR, External Input Select Register 


D8.28 TRCEXTINSELR, External Input Select Register 


The TRCEXTINSELR controls the selectors that choose an external input as a resource in the ETM trace 
unit. You can use the Resource Selectors to access these external input resources. 


Bit field descriptions 


29 28 2423 2120 1615 1312 


RESO 


Figure D8-26 TRCEXTINSELR bit assignments 
RESO, [31:29] 


RESO Reserved. 


SEL3, [28:24] 
Selects an event from the external input bus for External Input Resource 3. 


RESO, [23:21] 


RESO Reserved. 


SEL2, [20:16] 
Selects an event from the external input bus for External Input Resource 2. 


RESO, [15:13] 


RESO Reserved. 


SEL, [12:8] 
Selects an event from the external input bus for External Input Resource 1. 


RESO, [7:5] 


RESO Reserved. 


SELO, [4:0] 
Selects an event from the external input bus for External Input Resource 0. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCEXTINSELR can be accessed through the external debug interface, offset @x120. 
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D8 ETM registers 
D8.29 TRCIDRO, ID Register 0 


TRCIDRO, ID Register 0 


The TRCIDRO returns the tracing capabilities of the ETM trace unit. 


Bit field descriptions 
The TRCIDRO is a 32-bit register. 


31 30 29 28 24 23 17161514131211109 8 7 65 43 2 1 0 











L COMMOPT QSUPP 7 | |___ |NSTPO 
QFILT TRCDATA 
CONDTYPE TRCBB 
RES1 NUMEVENT TRCCOND 
RESO RETSTACK TRCCCI 


Figure D8-27 TRCIDRO bit assignments 

RESO, [31:30] 

RESO Reserved. 
COMMOPT, [29] 

Indicates the meaning of the commit field in some packets: 

1 Commit mode 1. 
TSSIZE, [28:24] 

Global timestamp size field: 

@be10ee@ Implementation supports a maximum global timestamp of 64 bits. 
RESO, [23:17] 

RESO Reserved. 
QSUPP, [16:15] 

Indicates Q element support: 

e@bee Q elements not supported. 
QFILT, [14] 

Indicates Q element filtering support: 

@be Q element filtering not supported. 
CONDTYPE, [13:12] 

Indicates how conditional results are traced: 

e@bee Conditional trace not supported. 
NUMEVENT, [11:10] 

Number of events supported in the trace, minus 1: 


@b11 Four events supported. 


RETSTACK, [9] 
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D8 ETM registers 
D8.29 TRCIDRO, ID Register 0 


Return stack support: 

1 Return stack implemented. 
RESO, [8] 

RESO Reserved. 


TRCCCI, [7] 

Support for cycle counting in the instruction trace: 

1 Cycle counting in the instruction trace is implemented. 
TRCCOND, [6] 

Support for conditional instruction tracing: 

) Conditional instruction tracing is not supported. 
TRCBB, [5] 

Support for branch broadcast tracing: 

1 Branch broadcast tracing is implemented. 
TRCDATA, [4:3] 

Conditional tracing field: 

@bee Tracing of data addresses and data values is not implemented. 
INSTPO, [2:1] 

PO tracing support field: 


e@bee Tracing of load and store instructions as PO elements is not supported. 
RES1, [0] 
RESI Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCIDRO can be accessed through the external debug interface, offset @x1E@. 
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D8 ETM registers 
D8.30 TRCIDR1, ID Register 1 


D8.30 TRCIDR1, ID Register 1 
The TRCIDR1 returns the base architecture of the trace unit. 


Bit field descriptions 
The TRCIDRI1 is a 32-bit register. 


31 24 23 1615 12 11 8 


7 4 3 0 
TRCARCHMAg — 
RES1 TRCARCHMIN 


RESO 


Figure D8-28 TRCIDR1 bit assignments 
DESIGNER, [31:24] 
Indicates which company designed the trace unit: 
@x41 = Arm. 
RESO, [23:16] 
RESO Reserved. 
RES1, [15:12] 
RESI Reserved. 
TRCARCHMAG, [11:8] 
Major trace unit architecture version number: 
@be10e0 ETMv4. 
TRCARCHMIN, [7:4] 
Minor trace unit architecture version number: 
@x2 ETMv4.2 
REVISION, [3:0] 
Trace unit implementation revision number: 


2 ETM revision. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCIDRI can be accessed through the external debug interface, offset @x1E4. 
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D8 ETM registers 
D8.31 TRCIDR2, ID Register 2 


TRCIDR2, ID Register 2 


The TRCIDR2 returns the maximum size of six parameters in the trace unit. 


The parameters are: 

¢ Cycle counter. 

¢ Data value. 

¢ Data address. 

« VMID. 

¢ Context ID. 

¢ Instruction address. 


Bit field descriptions 
The TRCIDR2 is a 32-bit register. 


31 29 28 25 24 20 19 15 14 10 9 5 4 0 
ii CCSIZE DVSIZE DASIZE VMIDSIZE CIDSIZE IASIZE 





VMIDOPT 


RESO 


Figure D8-29 TRCIDR2 bit assignments 
RESO, [31] 
RESO Reserved. 
VMIDOPT, [30:29] 
Indicates the options for observing the Virtual context identifier: 
ex1 VMIDOPT is implemented. 
CCSIZE, [28:25] 
Size of the cycle counter in bits minus 12: 
exe The cycle counter is 12 bits in length. 
DVSIZE, [24:20] 
Data value size in bytes: 
@xee@ _— Data value tracing is not implemented. 
DASIZE, [19:15] 
Data address size in bytes: 
@xe@ _— Data address tracing is not implemented. 
VMIDSIZE, [14:10] 
Virtual Machine ID size: 
@x4 Maximum of 32-bit Virtual Machine ID size. 
CIDSIZE, [9:5] 


Context ID size in bytes: 
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D8 ETM registers 
D8.31 TRCIDR2, ID Register 2 


0x4 Maximum of 32-bit Context ID size. 
IASIZE, [4:0] 


Instruction address size in bytes: 


@x8 Maximum of 64-bit address size. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCIDR2 can be accessed through the external debug interface, offset @x1E8. 
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D8 ETM registers 
D8.32 TRCIDR3, ID Register 3 


D8.32 TRCIDR3, ID Register 3 
The TRCIDR3 indicates: 


¢« Whether TRCVICTLR is supported. 

¢ The number of cores available for tracing. 

¢ Ifan Exception level supports instruction tracing. 

¢ The minimum threshold value for instruction trace cycle counting. 

¢ Whether the synchronization period is fixed. 

¢ Whether TRCSTALLCTLR is supported and if so whether it supports trace overflow prevention and 
supports stall control of the core. 


Bit field descriptions 
The TRCIDR3 is a 32-bit register. 


3130 28 27 26 25 24 23 20 19 1615 12 11 5 4 0 


EXLEVEL_S 
EXLEVEL_NS 
TRCERR 
SYNCPR 





STALLCTL 
SYSSTALL 
NUMPROC 
NOOVERFLOW 




















RESO 


Figure D8-30 TRCIDR3 bit assignments 

NOOVERFLOW, [31] 

Indicates whether TRCSTALLCTLR.NOOVERFLOW is implemented: 

() TRCSTALLCTLR.NOOVERFLOW is not implemented. 
NUMPROC, [30:28] 

Indicates the number of cores available for tracing: 

@beee = The trace unit can trace one core, ETM trace unit sharing not supported. 
SYSSTALL, [27] 

Indicates whether stall control is implemented: 

1 The system supports core stall control. 
STALLCTL, [26] 

Indicates whether TRCSTALLCTLR is implemented: 

1 TRCSTALLCTLR is implemented. 


This field is used in conjunction with SYSSTALL. 
SYNCPR, [25] 


Indicates whether there is a fixed synchronization period: 
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D8 ETM registers 
D8.32 TRCIDR3, ID Register 3 


() TRCSYNCPR is read-write so software can change the synchronization period. 


TRCERR, [24] 
Indicates whether TRCVICTLR.TRCERR is implemented: 
1 TRCVICTLR.TRCERR is implemented. 


EXLEVEL_NS, [23:20] 


Each bit controls whether instruction tracing in Non-secure state is implemented for the 
corresponding Exception level: 


@be111 Instruction tracing is implemented for Non-secure ELO, EL1, and EL2 Exception 
levels. 


EXLEVEL S, [19:16] 


Each bit controls whether instruction tracing in Secure state is implemented for the 
corresponding Exception level: 


@b1011 Instruction tracing is implemented for Secure ELO, EL1, and EL3 Exception levels. 
RESO, [15:12] 

RESO Reserved. 
CCITMIN, [11:0] 

The minimum value that can be programmed in TRCCCCTLR.THRESHOLD: 


@xee4 Instruction trace cycle counting minimum threshold is 4. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCIDR3 can be accessed through the external debug interface, offset @x1EC. 
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D8 ETM registers 
D8.33 TRCIDR4, ID Register 4 


D8.33  TRCIDR4, ID Register 4 


The TRCIDR4 indicates the resources available in the ETM trace unit. 


Bit field descriptions 
The TRCIDR4 is a 32-bit register. 


28 27 24 23 20 19 1615 12 11 98 7 


NUMVMIDC} NUMCIDC wumssec] | NUMPC ae | NUMDVC i 


NUMRSPAIRS — SUPPDAC — NUMACPAIRS — 
RESO 


Figure D8-31 TRCIDR4 bit assignments 
NUMVMIDC, [31:28] 
Indicates the number of VMID comparators available for tracing: 
@x1 One VMID comparator is available. 
NUMCIDC, [27:24] 
Indicates the number of CID comparators available for tracing: 
ex1 One Context ID comparator is available. 
NUMSSCC, [23:20] 
Indicates the number of single-shot comparator controls available for tracing: 
ex1 One single-shot comparator control is available. 
NUMRSPAIRS, [19:16] 
Indicates the number of resource selection pairs available for tracing: 
@x7 Eight resource selection pairs are available. 
NUMPC, [15:12] 
Indicates the number of core comparator inputs available for tracing: 
exe Core comparator inputs are not implemented. 
RESO, [11:9] 
RESO Reserved. 
SUPPDAC, [8] 
Indicates whether the implementation supports data address comparisons: This value is: 
7) Data address comparisons are not implemented. 
NUMDVGC, [7:4] 
Indicates the number of data value comparators available for tracing: 
exe Data value comparators not implemented. 
NUMACPAIRS, [3:0] 


Indicates the number of address comparator pairs available for tracing: 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D8-747 
reserved. 
Non-Confidential 


D8 ETM registers 
D8.33 TRCIDR4, ID Register 4 


ex4 Four address comparator pairs are implemented. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCIDR4 can be accessed through the external debug interface, offset @x1F@. 
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D8 ETM registers 
D8.34 TRCIDRS, ID Register 5 


D8.34 TRCIDRS, ID Register 5 


The TRCIDRS returns how many resources the trace unit supports. 
Bit field descriptions 


3130 2827 2524 23 22 21 1615 12 11 0 


[TU fesse [TE] [se 
}, Ae e L NUMEXTINSEL 
Lee 
NUMSEQSTATE 

NUMCNTR 

REDFUNCNTR 








RESO 


Figure D8-32 TRCIDRS5 bit assignments 

REDFUNCNTR, [31] 

Reduced Function Counter implemented: 

) Reduced Function Counter not implemented. 
NUMCNTR, [30:28] 

Number of counters implemented: 

@be1e@ Two counters implemented. 
NUMSEQSTATE, [27:25] 

Number of sequencer states implemented: 

@b10@ Four sequencer states implemented. 
RESO, [24] 

RESO Reserved. 
LPOVERRIDE, [23] 

Low-power state override support: 

1 Low-power state override support implemented. 
ATBTRIG, [22] 

ATB trigger support: 

1 ATB trigger support implemented. 
TRACEIDSIZE, [21:16] 

Number of bits of trace ID: 

@x@7 ~=Seven-bit trace ID implemented. 


RESO, [15:12] 


RESO Reserved. 


NUMEXTINSEL, [11:9] 
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D8 ETM registers 
D8.34 TRCIDRS, ID Register 5 


Number of external input selectors implemented: 


@b1e@ Four external input selectors implemented. 


NUMEXTIN, [8:0] 
Number of external inputs implemented: 


@x1E 30 external inputs implemented. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCIDRS can be accessed through the external debug interface, offset @x1F4. 
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D8 ETM registers 
D8.35 TRCIDR8, ID Register 8 


D8.35 TRCIDR8, ID Register 8 


The TRCIDR8 returns the maximum speculation depth of the instruction trace stream. 


Bit field descriptions 
The TRCIDR8 is a 32-bit register. 


31 0 


MAXSPEC 


Figure D8-33 TRCIDR8 bit assignments 
MAXSPEC, [31:0] 
The maximum number of PO elements in the trace stream that can be speculative at any time. 


7) Maximum speculation depth of the instruction trace stream. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCIDR8 can be accessed through the external debug interface, offset @x180. 
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D8 ETM registers 
D8.36 TRCIDRY, ID Register 9 


D8.36 TRCIDR9Y, ID Register 9 
The TRCIDR9 returns the number of PO right-hand keys that the trace unit can use. 


Bit field descriptions 
The TRCIDR39 is a 32-bit register. 


31 0 


NUMPOKEY 


Figure D8-34 TRCIDR9 bit assignments 
NUMPOKEY, [31:0] 
The number of PO right-hand keys that the trace unit can use. 
7) Number of PO right-hand keys. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCIDR9 can be accessed through the external debug interface, offset @x184. 
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D8 ETM registers 
D8.37 TRCIDR10, ID Register 10 


D8.37 TRCIDR10, ID Register 10 
The TRCIDR1O returns the number of P1 right-hand keys that the trace unit can use. 


Bit field descriptions 
The TRCIDR1O is a 32-bit register. 


31 0 


NUMP1KEY 


Figure D8-35 TRCIDR10 bit assignments 
NUMPIKEY, [31:0] 
The number of P1 right-hand keys that the trace unit can use. 
7) Number of P1 right-hand keys. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCIDR1O0 can be accessed through the external debug interface, offset @x188. 
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D8 ETM registers 
D8.38 TRCIDR11, ID Register 11 


D8.38 TRCIDR11, ID Register 11 
The TRCIDR11 returns the number of special P| right-hand keys that the trace unit can use. 


Bit field descriptions 
The TRCIDR11 is a 32-bit register. 


31 0 


NUMP1SPC 


Figure D8-36 TRCIDR11 bit assignments 
NUMPISPC, [31:0] 
The number of special P1 right-hand keys that the trace unit can use. 


7) Number of special P1 right-hand keys. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCIDR11 can be accessed through the external debug interface, offset @x18C. 
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D8 ETM registers 
D8.39 TRCIDR12, ID Register 12 


D8.39 TRCIDR12, ID Register 12 
The TRCIDR12 returns the number of conditional instruction right-hand keys that the trace unit can use. 


Bit field descriptions 
The TRCIDR1O is a 32-bit register. 


31 0 


NUMCONDKEY 


Figure D8-37 TRCIDR12 bit assignments 


NUMCONDKEY, [31:0] 


The number of conditional instruction right-hand keys that the trace unit can use, including 
normal and special keys. 


7) Number of conditional instruction right-hand keys. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCIDR12 can be accessed through the external debug interface, offset 0x19. 
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D8 ETM registers 
D8.40 TRCIDR13, ID Register 13 


D8.40 TRCIDR13, ID Register 13 
The TRCIDR13 returns the number of special conditional instruction right-hand keys that the trace unit 
can use. 
Bit field descriptions 
The TRCIDR11 is a 32-bit register. 


31 0 


NUMCONDSPC 


Figure D8-38 TRCIDR13 bit assignments 


NUMCONDSPC, [31:0] 


The number of special conditional instruction right-hand keys that the trace unit can use, 
including normal and special keys. 


() Number of special conditional instruction right-hand keys. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCIDR13 can be accessed through the external debug interface, offset @x194. 
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D8 ETM registers 
D8.41 TRCIMSPECO, IMPLEMENTATION SPECIFIC Register 0 


D8.41 TRCIMSPECO, IMPLEMENTATION SPECIFIC Register 0 


The TRCIMSPECO shows the presence of any IMPLEMENTATION SPECIFIC features, and enables any features 
that are provided. 


Bit field descriptions 
The TRCIMSPEC0 is a 32-bit register. 


31 4 3 0 
RESO pom 


Figure D8-39 TRCIMSPECO bit assignments 
RESO, [31:4] 
RESO Reserved. 
SUPPORT, [3:0] 


) No IMPLEMENTATION SPECIFIC extensions are supported. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCIMSPECO can be accessed through the external debug interface, offset @x1C@. 
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D8 ETM registers 
D8.42 TRCITATBIDR, Integration ATB Identification Register 


D8.42 TRCITATBIDR, Integration ATB Identification Register 
The TRCITATBIDR sets the state of output pins, mentioned in the bit descriptions in this section. 


Bit field descriptions 
The TRCITATBIDR is a 32-bit register. 


31 7 6 0 


eee 


Figure D8-40 TRCITATBIDR bit assignments 


[31:7] 
Reserved. Read undefined. 


ID, [6:0] 
Drives the ATIDMn[6:0] output pins. 
When a bit is set to 0, the corresponding output pin is LOW. 
When a bit is set to 1, the corresponding output pin is HIGH. 
The TRCITATBIDR bit values correspond to the physical state of the output pins. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCITATBIDR can be accessed through the external debug interface, offset @xEE4. 
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D8 ETM registers 
D8.43 TRCITCTRL, Integration Mode Control Register 


D8.43  TRCITCTRL, Integration Mode Control Register 


The TRCITCTRL enables topology detection or integration testing, by putting the ETM trace unit into 
integration mode. 


Bit field descriptions 
The TRCITCTRL is a 32-bit register. 


31 10 
IME zl 
RESO 


Figure D8-41 TRCITCTRL bit assignments 
RESO, [31:1] 


RESO Reserved. 


IME, [0] 
Integration mode enable bit. The possible values are: 
7) The trace unit is not in integration mode. 
1 The trace unit is in integration mode. This mode enables: 


« A debug agent to perform topology detection. 
* SoC test software to perform integration testing. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCITCTRL can be accessed through the external debug interface, offset @xFee. 
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D8 ETM registers 
D8.44 TRCITIATBINR, Integration Instruction ATB In Register 


TRCITIATBINR, Integration Instruction ATB In Register 


The TRCITIATBINR reads the state of the input pins described in this section. 


Bit field descriptions 
The TRCITIATBINR is a 32-bit register. 


31 


2 1 0 


re 


AFVALIDM 
ATREADYM 


el 


Figure D8-42 TRCITIATBINR bit assignments 


For all non-reserved bits: 
¢« When an input pin is LOW, the corresponding register bit is 0. 
¢ When an input pin is HIGH, the corresponding register bit is 1. 
¢ The TRCITIATBINR bit values always correspond to the physical state of the input pins. 
[31:2] 
Reserved. Read undefined. 


AFVALIDM, [1] 
Returns the value of the AFVALIDMn input pin. 


ATREADYM, [0] 
Returns the value of the ATREADYMn input pin. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCITIATBINR can be accessed through the external debug interface, offset @xEF4. 
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D8 ETM registers 
D8.45 TRCITIATBOUTR, Integration Instruction ATB Out Register 


D8.45 TRCITIATBOUTR, Integration Instruction ATB Out Register 


The TRCITIATBOUTR sets the state of the output pins mentioned in the bit descriptions in this section. 


Bit field descriptions 
The TRCITIATBOUTR is a 32-bit register. 


31 109 8 7 2 1 0 


pytes— AFREADY—| 
ATVALID 
Figure D8-43 TRCITIATBOUTR bit assignments 


For all non-reserved bits: 
« When a bit is set to 0, the corresponding output pin is LOW. 
¢ When a bit is set to 1, the corresponding output pin is HIGH. 
¢ The TRCITIATBOUTR bit values always correspond to the physical state of the output pins. 
[31:10] 
Reserved. Read undefined. 
BYTES, [9:8] 
Drives the ATBYTESMn[1:0] output pins. 
[7:2] 
Reserved. Read undefined. 


AFREADY, [1] 
Drives the AFREADYMn output pin. 


ATVALID, [0] 
Drives the ATVALIDMnhn output pin. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCITIATBOUTR can be accessed through the external debug interface, offset @xEFC. 
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D8 ETM registers 
D8.46 TRCITIDATAR, Integration Instruction ATB Data Register 


D8.46 TRCITIDATAR, Integration Instruction ATB Data Register 


The TRCITIDATAR sets the state of the ATDATAMn output pins shown in the TRCITIDATAR bit 
assignments table. 


Bit field descriptions 
The TRCITIDATAR is a 32-bit register. 


31 543210 


=, ATDATAM[31] — 
ATDATAM[23] 
ATDATAM[15] 


ATDATAM(7] 
ATDATAM[O] 


Figure D8-44 TRCITIDATAR bit assignments 

RESO, [31:5] 

RESO Reserved. 
ATDATAM{31], [4] 
Drives the ATDATAM[31] output. " 
ATDATAM[23], [3] 
Drives the ATDATAM[23] output.” 
ATDATAM[15], [2] 
Drives the ATDATAM[15] output.” 
ATDATAM[7], [1] 
Drives the ATDATAM[7] output." 
ATDATAM[0], [0] 

Drives the ATDATAM[0] output." 








Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCITIDATAR can be accessed through the external debug interface, offset @xEEC. 





n When a bit is set to @, the corresponding output pin is LOW. When a bit is set to 1, the corresponding output pin is HIGH. The TRCITIDATAR bit values correspond 
to the physical state of the output pins. 
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D8 ETM registers 
D8.47 TRCLAR, Software Lock Access Register 


D8.47 TRCLAR, Software Lock Access Register 


The TRCLAR controls access to registers using the memory-mapped interface, when PADDRDBG31 is 
LOW. 


When the software lock is set, write accesses using the memory-mapped interface to all ETM trace unit 
registers are IGNORED, except for write accesses to the TRCLAR. 


When the software lock is set, read accesses of TRCPDSR do not change the TRCPDSR.STICKYPD bit. 
Read accesses of all other registers are not affected. 


Bit field descriptions 
The TRCLAR is a 32-bit register. 


31 0 


Figure D8-45 TRCLAR bit assignments 
KEY, [31:0] 
Software lock key value: 


@xC5ACCE55 Clear the software lock. 


All other write values set the software lock. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCLAR can be accessed through the external debug interface, offset @xFBe. 
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D8 ETM registers 
D8.48 TRCLSR, Software Lock Status Register 


TRCLSR, Software Lock Status Register 


The TRCLSR determines whether the software lock is implemented, and indicates the current status of 
the software lock. 


Bit field descriptions 
The TRCLSR is a 32-bit register. 


31 3.210 


RESO nt 
SLK 


SLI 


Figure D8-46 TRCLSR bit assignments 
RESO, [31:3] 
RESO Reserved. 
nTT, [2] 
Indicates size of TRCLAR: 
7) TRCLAR is always 32 bits. 


SLK, [1] 
Software lock status: 
7) Software lock is clear. 
1 Software lock is set. 
SLI, [0] 
Indicates whether the software lock is implemented on this interface. 


1 Software lock is implemented on this interface. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCLSR can be accessed through the external debug interface, offset @xFB4. 
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D8 ETM registers 
D8.49 TRCCNTVRn, Counter Value Registers 0-1 


D8.49 TRCCNTVRn, Counter Value Registers 0-1 


The TRCCNTVRn contains the current counter value. 


Bit field descriptions 
The TRCCNTVRn is a 32-bit register. 


31 1615 0 


VALUE 


RESO 





Figure D8-47 TRCCNTVRn bit assignments 


RESO, [31:16] 


RESO Reserved. 


VALUE, [15:0] 
Contains the current counter value. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCCNTVRn registers can be accessed through the external debug interface, offsets: 


TRCCNTVRO 
6x16. 


TRCCNTVRI 
6x164. 
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D8 ETM registers 
D8.50 TRCOSLAR, OS Lock Access Register 


D8.50 TRCOSLAR, OS Lock Access Register 


The TRCOSLAR sets and clears the OS Lock, to lock out external debugger accesses to the ETM trace 
unit registers. 


Bit field descriptions 
The TRCOSLAR is a 32-bit register. 


31 10 
RESO osik— 


Figure D8-48 TRCOSLAR bit assignments 
RESO, [31:1] 
RESO Reserved. 
OSLK, [0] 
OS Lock key value: 
) Unlock the OS Lock. 
1 Lock the OS Lock. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCOSLAR can be accessed through the external debug interface, offset @x300. 
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D8 ETM registers 
D8.51 TRCOSLSR, OS Lock Status Register 


D8.51 TRCOSLSR, OS Lock Status Register 
The TRCOSLSR returns the status of the OS Lock. 


Bit field descriptions 
The TRCOSLSR is a 32-bit register. 


31 43210 


RESO ost} 
nTT 
OSLK 


OSLM[O0] 


Figure D8-49 TRCOSLSR bit assignments 
RESO, [31:4] 
RESO Reserved. 
OSLM[1], [3] 


OS Lock model [1] bit. This bit is combined with OSLM[0] to form a two-bit field that indicates 
the OS Lock model is implemented. 


The value of this field is always @b1, indicating that the OS Lock is implemented. 


nTT, [2] 
This bit is RAZ, that indicates that software must perform a 32-bit write to update the 
TRCOSLAR. 


OSLK, [1] 
OS Lock status bit: 
i) OS Lock is unlocked. 
1 OS Lock is locked. 
OSLM/[0], [0] 


OS Lock model [0] bit. This bit is combined with OSLM[1] to form a two-bit field that indicates 
the OS Lock model is implemented. 


The value of this field is always @b18, indicating that the OS Lock is implemented. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCOSLSR can be accessed through the external debug interface, offset @x304. 
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D8 ETM registers 
D8.52 TRCPDCR, Power Down Control Register 
D8.52 TRCPDCR, Power Down Control Register 
The TRCPDCR request to the system power controller to keep the ETM trace unit powered up. 


Bit field descriptions 
The TRCPDCR is a 32-bit register. 


31 43 2 0 
Pu— 
RESO 


Figure D8-50 TRCPDCR bit assignments 
RESO, [31:4] 
RESO Reserved. 
PU, [3] 


Powerup request, to request that power to the ETM trace unit and access to the trace registers is 
maintained: 


) Power not requested. 


1 Power requested. 


This bit is reset to 0 on a trace unit reset. 
RESO, [2:0] 


RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé8, for Armv8-A architecture profile. 


The TRCPDCR can be accessed through the external debug interface, offset @x310. 
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D8 ETM registers 
D8.53 TRCPDSR, Power Down Status Register 


D8.53 TRCPDSR, Power Down Status Register 
The TRCPDSR indicates the power down status of the ETM trace unit. 


Bit field descriptions 
The TRCPDSR is a 32-bit register. 


31 6 5 4 2 1 0 


OSLK— 
RESO STICKYPD 
POWER 


Figure D8-51 TRCPDSR bit assignments 
RESO, [31:6] 


RESO Reserved. 


OSLK, [5] 
OS lock status. 
7) The OS Lock is unlocked. 
1 The OS Lock is locked. 
RESO, [4:2] 


RESO Reserved. 


STICKYPD, [1] 
Sticky power down state. 
7) Trace register power has not been removed since the TRCPDSR was last read. 


1 Trace register power has been removed since the TRCPDSR was last read. 


This bit is set to | when power to the ETM trace unit registers is removed, to indicate that 
programming state has been lost. It is cleared after a read of the TRCPDSR. 
POWER, [0] 


Indicates the ETM trace unit is powered: 


7) ETM trace unit is not powered. The trace registers are not accessible and they all 
return an error response. 


1 ETM trace unit is powered. All registers are accessible. 


If a system implementation allows the ETM trace unit to be powered off independently of the 
debug power domain, the system must handle accesses to the ETM trace unit appropriately. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCPDSR can be accessed through the external debug interface, offset @x314. 
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D8 ETM registers 
D8.54 TRCPIDRO, ETM Peripheral Identification Register 0 


D8.54 TRCPIDRO, ETM Peripheral Identification Register 0 
The TRCPIDRO provides information to identify a trace component. 


Bit field descriptions 
The TRCPIDR0O is a 32-bit register. 


31 8 7 0 


a 


RESO 


Figure D8-52 TRCPIDRO bit assignments 
RESO, [31:8] 
RESO Reserved. 
Part_0, [7:0] 
e@xe5 _— Least significant byte of the ETM trace unit part number. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCPIDRO can be accessed through the external debug interface, offset @xFEO. 
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D8 ETM registers 
D8.55 TRCPIDR1, ETM Peripheral Identification Register 1 


D8.55 TRCPIDR1, ETM Peripheral Identification Register 1 
The TRCPIDR1 provides information to identify a trace component. 


Bit field descriptions 
The TRCPIDR1 is a 32-bit register. 


31 8 7 4 3 0 


RESO 


Figure D8-53 TRCPIDR1 bit assignments 
RESO, [31:8] 
RESO Reserved. 
DES_0, [7:4] 
@xB Arm Limited. This is bits[3:0] of JEP106 ID code. 
Part_1, [3:0] 
@xD Most significant four bits of the ETM trace unit part number. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCPIDRI can be accessed through the external debug interface, offset @xFE4. 
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D8 ETM registers 
D8.56 TRCPIDR2, ETM Peripheral Identification Register 2 


TRCPIDR2, ETM Peripheral Identification Register 2 


The TRCPIDR2 provides information to identify a trace component. 


Bit field descriptions 
The TRCPIDR2 is a 32-bit register. 


31 8 7 432 0 
JEDEC —! 
RESO 


Figure D8-54 TRCPIDR2 bit assignments 
RESO, [31:8] 
RESO Reserved. 
Revision, [7:4] 


@x2 ETM revision. 


JEDEC, [3] 

@b1 RES1. Indicates a JEP 106 identity code is used. 
DES 1, [2:0] 

@be11 Arm Limited. This is bits[6:4] of JEP106 ID code. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCPIDR2 can be accessed through the external debug interface, offset @xFE8. 
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D8 ETM registers 
D8.57 TRCPIDR3, ETM Peripheral Identification Register 3 


TRCPIDR3, ETM Peripheral Identification Register 3 


The TRCPIDR3 provides information to identify a trace component. 


Bit field descriptions 
The TRCPIDR3 is a 32-bit register. 


31 8 7 4 3 0 
RESO 


Figure D8-55 TRCPIDR3 bit assignments 
RESO, [31:8] 


RESO Reserved. 


REVAND, [7:4] 


@xe Part minor revision. 
CMOD, [3:0] 
@xe Not customer modified. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCPIDR3 can be accessed through the external debug interface, offset @xFEC. 
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D8 ETM registers 
D8.58 TRCPIDR4, ETM Peripheral Identification Register 4 


D8.58 TRCPIDR4, ETM Peripheral Identification Register 4 
The TRCPIDR4 provides information to identify a trace component. 


Bit field descriptions 
The TRCPIDR4 is a 32-bit register. 


31 8 7 4 3 0 


RESO 


Figure D8-56 TRCPIDR4 bit assignments 
RESO, [31:8] 
RESO Reserved. 
Size, [7:4] 


exe Size of the component. Log2 the number of 4KB pages from the start of the 
component to the end of the component ID registers. 


DES _2, [3:0] 
@x4 Arm Limited. This is bits[3:0] of the JEP106 continuation code. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCPIDR4 can be accessed through the external debug interface, offset @xFD@. 
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D8 ETM registers 
D8.59 TRCPIDRn, ETM Peripheral Identification Registers 5-7 


D8.59 TRCPIDRn, ETM Peripheral Identification Registers 5-7 
No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 
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D8 ETM registers 
D8.60 TRCPRGCTLR, Programming Control Register 


D8.60 TRCPRGCTLR, Programming Control Register 
The TRCPRGCTLR enables the ETM trace unit. 


Bit field descriptions 
The TRCPRGCTLR is a 32-bit register. 


31 10 


as 


en 





RESO 


Figure D8-57 TRCPRGCTLR bit assignments 
RESO, [31:1] 
RESO Reserved. 
EN, [0] 
Trace program enable: 


) The ETM trace unit interface in the core is disabled, and clocks are enabled only when 
necessary to process APB accesses, or drain any already generated trace. This is the 
reset value. 


1 The ETM trace unit interface in the core is enabled, and clocks are enabled. Writes to 
most trace registers are IGNORED. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCPRGCTLR can be accessed through the external debug interface, offset @xee4. 
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D8 ETM registers 
D8.61 TRCRSCTLRn, Resource Selection Control Registers 2-16 


TRCRSCTLRn, Resource Selection Control Registers 2-16 


The TRCRSCTLRn controls the trace resources. There are eight resource pairs, the first pair is 
predefined as {0,1,pair=0} and having reserved select registers. This leaves seven pairs to be 
implemented as programmable selectors. 


Bit field descriptions 
The TRCRSCTLRn is a 32-bit register. 


31 2221201918 1615 8 7 0 


PAIRINV— LINv 
RESO 


Figure D8-58 TRCRSCTLRn bit assignments 
RESO, [31:22] 
RESO Reserved. 
PAIRINY, [21] 
Inverts the result of a combined pair of resources. 
This bit is implemented only on the lower register for a pair of resource selectors. 
INV, [20] 


Inverts the selected resources: 


(7) Resource is not inverted. 
1 Resource is inverted. 
RESO, [19] 


RESO Reserved. 


GROUP, [18:16] 


Selects a group of resources. See the Arm® ETM Architecture Specification, ETMv4 for more 
information. 


RESO, [15:8] 
RESO Reserved. 
SELECT, [7:0] 


Selects one or more resources from the required group. One bit is provided for each resource 
from the group. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCRSCTLRn can be accessed through the external debug interface, offset @x208-@x23C. 
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D8 ETM registers 
D8.62 TRCSEQEVRn, Sequencer State Transition Control Registers 0-2 


TRCSEQEVRn, Sequencer State Transition Control Registers 0-2 


The TRCSEQEVRn defines the sequencer transitions that progress to the next state or backwards to the 
previous state. The ETM trace unit implements a sequencer state machine with up to four states. 


Bit field descriptions 
The TRCSEQEVRn is a 32-bit register. 


31 161514 1211 876 43 0 
B TYPE—! F TYPE— 
RESO 


Figure D8-59 TRCSEQEVRnh bit assignments 

RESO, [31:16] 

RESO Reserved. 
B TYPE, [15] 

Selects the resource type to move backwards to this state from the next state: 

7) Single selected resource. 

1 Boolean combined resource pair. 
RESO, [14:12] 

RESO Reserved. 
B SEL, [11:8] 

Selects the resource number, based on the value of B TYPE: 

When B TYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 

When B TYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
F TYPE, [7] 


Selects the resource type to move forwards from this state to the next state: 


@ Single selected resource. 
1 Boolean combined resource pair. 
RESO, [6:4] 


RESO Reserved. 


F SEL, [3:0] 
Selects the resource number, based on the value of F TYPE: 
When F TYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When F TYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCSEQEVRn registers can be accessed through the external debug interface, offsets: 
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D8 ETM registers 
D8.62 TRCSEQEVRn, Sequencer State Transition Control Registers 0-2 


TRCSEQEVRO 
Qx10@. 


TRCSEQEVRI 
0x104. 


TRCSEQEVR2 
0x18. 
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D8 ETM registers 
D8.63 TRCSEQRSTEVR, Sequencer Reset Control Register 


TRCSEQRSTEVR, Sequencer Reset Control Register 


The TRCSEQRSTEVR resets the sequencer to state 0. 


Bit field descriptions 
The TRCSEQRSTEVR is a 32-bit register 


31 876 43 0 
RESETTYPE— 
RESO 


Figure D8-60 TRCSEQRSTEVR bit assignments 
RESO, [31:8] 
RESO Reserved. 
RESETTYPE, [7] 


Selects the resource type to move back to state 0: 


7) Single selected resource. 
1 Boolean combined resource pair. 
RESO, [6:4] 


RESO Reserved. 


RESETSEL, [3:0] 
Selects the resource number, based on the value of RESETTYPE: 
When RESETTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 


When RESETTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by 
bits[2:0]. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCSEQRSTEVR can be accessed through the external debug interface, offset @x118. 





100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights D8-780 


reserved. 
Non-Confidential 


D8 ETM registers 
D8.64 TRCSEQSTR, Sequencer State Register 


D8.64 TRCSEQSTR, Sequencer State Register 
The TRCSEQSTR holds the value of the current state of the sequencer. 


Bit field descriptions 
The TRCSEQSTR is a 32-bit register 





31 210 
STATE —! 
RESO 


Figure D8-61 TRCSEQSTR bit assignments 
RESO, [31:2] 
RESO Reserved. 
STATE, [1:0] 
Current sequencer state: 


@bee ~~ State 0. 
@be1 State 1. 
@b10 State 2. 
@b11_ ~— State 3. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé, for Armv8-A architecture profile. 


The TRCSEQSTR can be accessed through the external debug interface, offset @x11C. 
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D8 ETM registers 
D8.65 TRCSSCCRO, Single-Shot Comparator Control Register 0 


D8.65 TRCSSCCRO, Single-Shot Comparator Control Register 0 
The TRCSSCCRO controls the single-shot comparator. 


Bit field descriptions 
The TRCSSCSR0 is a 32-bit register 


31 25 24 23 20 19 1615 8 7 0 
RsT— 
RESO 


Figure D8-62 TRCSSCCRO bit assignments 
RESO, [31:25] 
RESO Reserved. 
RST, [24] 


Enables the single-shot comparator resource to be reset when it occurs, to enable another 
comparator match to be detected: 


1 Reset enabled. Multiple matches can occur. 
RESO, [23:20] 
RESO Reserved. 
ARC, [19:16] 
Selects one or more address range comparators for single-shot control. 
One bit is provided for each implemented address range comparator. 
RESO, [15:8] 
RESO Reserved. 
SAC, [7:0] 
Selects one or more single address comparators for single-shot control. 
One bit is provided for each implemented single address comparator. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCSSCCRO can be accessed through the external debug interface, offset 0x28. 
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D8 ETM registers 
D8.66 TRCSSCSRO, Single-Shot Comparator Status Register 0 


D8.66 TRCSSCSRO, Single-Shot Comparator Status Register 0 


The TRCSSCSRO indicates the status of the single-shot comparator. TRCSSCSR0O is sensitive to 
instruction addresses. 


Bit field descriptions 
The TRCSSCSR0 is a 32-bit register 


31 30 3.2 10 


L_STATUS pbyv— 
DA 
= INST 


Figure D8-63 TRCSSCSR0O bit assignments 
STATUS, [31] 
Single-shot status. This indicates whether any of the selected comparators have matched: 
) Match has not occurred. 


1 Match has occurred at least once. 


When programming the ETM trace unit, if TRCSSCCRn.RST is b0, the STATUS bit must be 
explicitly written to 0 to enable this single-shot comparator control. 


RESO, [30:3] 

RESO Reserved. 
DY, [2] 

Data value comparator support: 

) Single-shot data value comparisons not supported. 
DA, [1] 

Data address comparator support: 

) Single-shot data address comparisons not supported. 
INST, [0] 

Instruction address comparator support: 


1 Single-shot instruction address comparisons supported. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCSSCSRO can be accessed through the external debug interface, offset @x2A@. 
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D8 ETM registers 
D8.67 TRCSTALLCTLR, Stall Control Register 


TRCSTALLCTLR, Stall Control Register 


The TRCSTALLCTLR enables the ETM trace unit to stall the Cortex-A55 core if the ETM trace unit 
FIFO overflows. 


Bit field descriptions 
The TRCSTALLCTLR is a 32-bit register. 


31 98 7 43210 


eee ee 


RESO ISTALL ca] LEVEL _| 
Figure D8-64 TRCSTALLCTLR bit assignments 
RESO, [31:9] 
RESO Reserved. 
ISTALL, [8] 


Instruction stall bit. Controls if the trace unit can stall the core when the instruction trace buffer 
space is less than LEVEL: 


(7) The trace unit does not stall the core. 
1 The trace unit can stall the core. 
RESO, [7:4] 


RESO Reserved. 
LEVEL, [3:2] 
Threshold level field. The field can support 4 monotonic levels from @b@@ to @b11, where: 


@bee@ = Zero invasion. This setting has a greater risk of an ETM trace unit FIFO overflow. 


@b11 Maximum invasion occurs but there is less risk of a FIFO overflow. 


RESO, [1:0] 


RESO Reserved. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCSTALLCTLR can be accessed through the external debug interface, offset @x@2C. 
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D8 ETM registers 
D8.68 TRCSTATR, Status Register 


D8.68 TRCSTATR, Status Register 
The TRCSTATR indicates the ETM trace unit status. 


Bit field descriptions 
The TRCSTATR is a 32-bit register. 





31 210 
PMSTABLE — 
RESO IDLE 


Figure D8-65 TRCSTATR bit assignments 
RESO, [31:2] 
RESO Reserved. 
PMSTABLE, [1] 


Indicates whether the ETM trace unit registers are stable and can be read: 


) The programmers model is not stable. 

1 The programmers model is stable. 
IDLE, [0] 

Idle status: 

() The ETM trace unit is not idle. 

1 The ETM trace unit is idle. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCSTATR can be accessed through the external debug interface, offset @x@@C. 
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D8 ETM registers 
D8.69 TRCSYNCPR, Synchronization Period Register 


D8.69 TRCSYNCPR, Synchronization Period Register 


The TRCSYNCPR controls how often periodic trace synchronization requests occur. 


Bit field descriptions 
The TRCSYNCPR is a 32-bit register. 


31 5 4 0 


RESO 


Figure D8-66 TRCSYNCPR bit assignments 
RESO, [31:5] 


RESO Reserved. 


PERIOD, [4:0] 

Defines the number of bytes of trace between synchronization requests as a total of the number 

of bytes generated by both the instruction and data streams. The number of bytes is 2N where N 

is the value of this field: 

« A value of zero disables these periodic synchronization requests, but does not disable other 
synchronization requests. 

¢ The minimum value that can be programmed, other than zero, is 8, providing a minimum 
synchronization period of 256 bytes. 

* The maximum value is 20, providing a maximum synchronization period of 27° bytes. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCSYNCPR can be accessed through the external debug interface, offset @x@34. 
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D8 ETM registers 
D8.70 TRCTRACEIDR, Trace ID Register 


D8.70 TRCTRACEIDR, Trace ID Register 
The TRCTRACEIDR sets the trace ID for instruction trace. 


Bit field descriptions 
The TRCTRACEIDR is a 32-bit register. 


31 7 6 0 


RESO 


Figure D8-67 TRCTRACEIDR bit Assignments 
RESO, [31:7] 
RESO Reserved. 
TRACEID, [6:0] 
Trace ID value. When only instruction tracing is enabled, this provides the trace ID. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCTRACEIDR can be accessed through the external debug interface, offset 0x04e. 
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D8 ETM registers 
D8.71 TRCTSCTLR, Global Timestamp Control Register 


D8.71 TRCTSCTLR, Global Timestamp Control Register 


The TRCTSCTLR controls the insertion of global timestamps in the trace streams. When the selected 
event is triggered, the trace unit inserts a global timestamp into the trace streams. The event is selected 
from one of the Resource Selectors. 


Bit field descriptions 
The TRCTSCTLR is a 32-bit register. 


31 876 43 0 
L_TYPE 
RESO 


Figure D8-68 TRCTSCTLR bit assignments 
RESO, [31:8] 


RESO Reserved. 


TYPE, [7] 
Single or combined resource selector. 


RESO, [6:4] 
RESO Reserved. 
SEL, [3:1] 
Identifies the resource selector to use. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCTSCTLR can be accessed through the external debug interface, offset @x@3@. 
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D8 ETM registers 
D8.72 TRCVICTLR, Viewlnst Main Control Register 


D8.72 TRCVICTLR, Viewinst Main Control Register 
The TRCVICTLR controls instruction trace filtering. 


Bit field descriptions 
The TRCVICTLR is a 32-bit register. 


31 24 23 20 19 1615 1211109 8 7 6 


L EXLEVEL_S L TYPE 
RESO EXLEVEL_NS SSSTATUS 
TRCRESET 
TRCERR 


Figure D8-69 TRCVICTLR bit assignments 


RESO, [31:24] 


RESO Reserved. 


EXLEVEL_NS, [23:20] 


In Non-secure state, each bit controls whether instruction tracing is enabled for the 
corresponding Exception level: 


7) Trace unit generates instruction trace, in Non-secure state, for Exception level n. 
1 Trace unit does not generate instruction trace, in Non-secure state, for Exception level 
n. 


The Exception levels are: 
Bit[20]_ Exception level 0. 


Bit[21]_ Exception level 1. 
Bit[22] Exception level 2. 
Bit[23] RAZ/WI. Instruction tracing is not implemented for Exception level 3. 


EXLEVEL 5S, [19:16] 


In Secure state, each bit controls whether instruction tracing is enabled for the corresponding 
Exception level: 


7) Trace unit generates instruction trace, in Secure state, for Exception level n. 


1 Trace unit does not generate instruction trace, in Secure state, for Exception level n. 


The Exception levels are: 

Bit[16] Exception level 0. 

Bit[17] Exception level 1. 

Bit[18] RAZ/WI. Instruction tracing is not implemented for Exception level 2. 
Bit[19] Exception level 3. 


RESO, [15:12] 


RESO Reserved. 


TRCERR, [11] 
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D8 ETM registers 
D8.72 TRCVICTLR, Viewlnst Main Control Register 


Selects whether a system error exception must always be traced: 


7) System error exception is traced only if the instruction or exception immediately 
before the system error exception is traced. 


1 System error exception is always traced regardless of the value of ViewInst. 
TRCRESET, [10] 
Selects whether a reset exception must always be traced: 


7) Reset exception is traced only if the instruction or exception immediately before the 
reset exception is traced. 


1 Reset exception is always traced regardless of the value of ViewInst. 


SSSTATUS, [9] 


Indicates the current status of the start/stop logic: 


@ Start/stop logic is in the stopped state. 
1 Start/stop logic is in the started state. 
RESO, [8] 


RESO Reserved. 


TYPE, [7] 
Selects the resource type for the viewinst event: 
@ Single selected resource. 
1 Boolean combined resource pair. 
RESO, [6:4] 


RESO Reserved. 
SEL, [3:0] 
Selects the resource number to use for the viewinst event, based on the value of TYPE: 
When TYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCVICTLR can be accessed through the external debug interface, offset 0x@80. 
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D8 ETM registers 
D8.73 TRCVIIECTLR, ViewInst Include-Exclude Control Register 


D8.73. TRCVIIECTLR, Viewlnst Include-Exclude Control Register 


The TRCVIIECTLR defines the address range comparators that control the ViewInst Include/Exclude 
control. 


Bit field descriptions 
The TRCVIIECTLR is a 32-bit register. 


31 20 19 1615 4 3 0 
RESO 


Figure D8-70 TRCVIIECTLR bit assignments 
RESO, [31:20] 


RESO Reserved. 


EXCLUDE, [19:16] 
Defines the address range comparators for ViewInst exclude control. One bit is provided for 
each implemented Address Range Comparator. 


RESO, [15:4] 
RESO Reserved. 
INCLUDE, [3:0] 
Defines the address range comparators for ViewInst include control. 


Selecting no include comparators indicates that all instructions must be included. The exclude 
control indicates which ranges must be excluded. 


One bit is provided for each implemented Address Range Comparator. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCVIIECTLR can be accessed through the external debug interface, offset 0x084. 
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D8 ETM registers 
D8.74 TRCVISSCTLR, ViewInst Start-Stop Control Register 


D8.74 TRCVISSCTLR, Viewlnst Start-Stop Control Register 
The TRCVISSCTLR defines the single address comparators that control the ViewInst Start/Stop logic. 


Bit field descriptions 
The TRCVISSCTLR is a 32-bit register. 


31 24 23 1615 8 7 0 


RESO 


Figure D8-71 TRCVISSCTLR bit assignments 
RESO, [31:24] 
RESO Reserved. 
STOP, [23:16] 
Defines the single address comparators to stop trace with the ViewInst Start/Stop control. 
One bit is provided for each implemented single address comparator. 
RESO, [15:8] 
RESO Reserved. 
START, [7:0] 
Defines the single address comparators to start trace with the ViewInst Start/Stop control. 
One bit is provided for each implemented single address comparator. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv6, for Armv8-A architecture profile. 


The TRCVISSCTLR can be accessed through the external debug interface, offset 0x088. 
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D8 ETM registers 
D8.75 TRCVMIDCVRO, VMID Comparator Value Register 0 


D8.75 TRCVMIDCVRO, VMID Comparator Value Register 0 
The TRCVMIDCVR0 contains a VMID value. 


Bit field descriptions 
The TRCVMIDCVRO is a 64-bit register. 


63 32 31 0 


RESO 


Figure D8-72 TRCVMIDCVR0O bit assignments 
RESO, [63:32] 
RESO Reserved. 
VALUE, [31:0] 
The VMID value. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armvé6, for Armv8-A architecture profile. 


The TRCVMIDCVRO can be accessed through the external debug interface, offset @x649. 
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D8 ETM registers 
D8.76 TRCVMIDCCTLRO, Virtual context identifier Comparator Control Register 0 


D8.76 TRCVMIDCCTLRO, Virtual context identifier Comparator Control Register 0 


The TRCVMIDCCTLRO contains the Virtual machine identifier mask value for the TRCVMIDCVRO 
register. 


Bit field descriptions 
The TRCVMIDCCTLR0O is a 32-bit register. 


31 4 3 0 


RESO 


Figure D8-73 TRCVMIDCCTLRO bit assignments 
RESO, [31:4] 
RESO Reserved. 
COMPO, [3:0] 


Controls the mask value that the trace unit applies to TRCVMIDCVRO. Each bit in this field 
corresponds to a byte in TRCVMIDCVRO. When a bit is: 


7) The trace unit includes the relevant byte in TRCVMIDCVRO when it performs the 
Virtual context ID comparison. 
1 The trace unit ignores the relevant byte in TRCVMIDCVR0O when it performs the 


Virtual context ID comparison. 


Bit fields and details not provided in this description are architecturally defined. See the Arm® 
Architecture Reference Manual Armv8, for Armv8-A architecture profile. 


The TRCVMIDCCTLR0O can be accessed through the external debug interface, offset @x688. 
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Part E 
Appendices 


Appendix A 
AArch32 UNPREDICTABLE Behaviors 


This appendix describes the cases in which the Cortex-A55 core implementation diverges from the 
preferred behavior described in Armv8-A AArch32 UNPREDICTABLE behaviors. 


It contains the following sections: 

¢ A.J Use of R15 by Instruction on page Appx-A-798. 

¢ A.2 UNPREDICTABLE instructions within an IT Block on page Appx-A-799. 
¢ A.3 Load/Store accesses crossing page boundaries on page Appx-A-800. 

¢ A.4 Arm*v8-A Debug UNPREDICTABLE behaviors on page Appx-A-801. 

¢ A.5 Other UNPREDICTABLE behaviors on page Appx-A-804. 
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A AArch32 UNPREDICTABLE Behaviors 
A.1 Use of R15 by Instruction 


A.1 Use of R15 by Instruction 


All uses of R15 as a named register specifier for a source register that is described as UNPREDICTABLE take 
an UNDEFINED exception trap. 


For information on UNPREDICTABLE registers, see the Arm® Architecture Reference Manual Armv8, for 
Armv8-A architecture profile. 
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A AArch32 UNPREDICTABLE Behaviors 
A.2 UNPREDICTABLE instructions within an IT Block 


A.2 UNPREDICTABLE instructions within an IT Block 


Conditional instructions within an IT Block, described as being UNPREDICTABLE in the Arm® Architecture 
Reference Manual Armvé, for Armv8s-A architecture profile pseudo-code, are executed unconditionally. 


The Cortex-A55 core does not implement an unconditional execution policy for the following 
instructions. Instead all execute conditionally: 

¢ NEON instructions new to Armv8-A. 

¢ All instructions in the Armv8-A Cryptographic Extension. 

* CRC32. 
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A AArch32 UNPREDICTABLE Behaviors 
A.3 Load/Store accesses crossing page boundaries 


A.3 Load/Store accesses crossing page boundaries 


The Cortex-A55 processor implements a set of behaviors for load or store accesses that cross page 
boundaries. 


Crossing a page boundary with different memory types or shareability attributes 


The Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile, states that a 
memory access from a load or store instruction that crosses a page boundary to a memory 
location that has a different memory type or shareability attribute results in CONSTRAINED 
UNPREDICTABLE behavior. 


Crossing a 4KB boundary with a Device access 


The Arm® Architecture Reference Manual Armv8, for Armv8-A architecture profile, states that a 
memory access from a load or store instruction to Device memory that crosses a 4KB boundary 
results in CONSTRAINED UNPREDICTABLE behavior. 


Implementation (for both page boundary specifications) 
For an access that crosses a page boundary, the Cortex-A55 processor implements the following 
behaviors: 
¢ Store crossing a page boundary: 
— No alignment fault. 
— The access is split into two stores. 
— Each store uses the memory type and shareability attributes associated with its own 
address. 
¢ Load crossing a page boundary (Device to Device and Normal to Normal): 
— No alignment fault. 
— The access is split into two loads. 
— Each load uses the memory type and shareability attributes associated with its own 
address. 
¢ Load crossing a page boundary (Device to Normal and Normal to Device): 
— The instruction might generate an alignment fault. 
— Ifno fault is generated, the access is split into two loads. 
— Each load uses the memory type and shareability attributes associated with its own 
address. 





100442 0200_00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights Appx-A-800 
reserved. 
Non-Confidential 


A AArch32 UNPREDICTABLE Behaviors 
A.4 Arm®v8-A Debug UNPREDICTABLE behaviors 





A.4 Arm®v8-A Debug UNPREDICTABLE behaviors 
There are UNPREDICTABLE behaviors associated with Debug. 
The information in this section describes which option the Cortex-A55 core implements based on the 
behavior. 
Table A-1 Armv8-A Debug UNPREDICTABLE behaviors 
Scenario Behavior 





A32 BKPT instruction with condition code not 
AL 


The core implements the following preferred option: 
* Option 3: Executed unconditionally. 





Address match breakpoint match only on 
second halfword of an instruction 


The core generates a breakpoint on the instruction, unless it is a breakpoint on the 
second half of the 32-bit instruction. In this case, the breakpoint is not taken. 





Address matching breakpoint on A32 
instruction with DBGBCRn.BAS=1100 


The core implements the following option: 
« Option 1: Does match. 





Address match breakpoint match on T32 
instruction at DBGBCRn+2 with 
DBGBCRn.BAS=1111 


The core implements the following option: 


¢ Option 1: Does match. 





Address mismatch breakpoint match on T32 
instruction at DBGBCRn +2 with 
DBGBCRn.BAS=1111 


The core implements the following option: 
¢ Option 1: Does match. 





Other mismatch breakpoint matches any address 
in current mode and state 


The core implements the following option: 
¢ Option 2: Immediate breakpoint debug event. 





Mismatch breakpoint on branch to self 


The core implements the following option: 
* Option 2: Instruction is stepped an UNKNOWN number of times, while it 
continues to branch to itself. 





Link to non-existent breakpoint or breakpoint 
that is not context-aware 


The core implements the following option: 
* Option 1: No Breakpoint or Watchpoint debug event is generated, and the LBN 
field of the Jinker reads UNKNOWN. 





DBGWCRn_EL1.MASK!=00000 and 
DBGWCRn EL1.BAS!=11111111 


The core behaves as indicated in the sole Preference: 
* DBGWCRn_EL1.BAS is IGNORED and treated as if @x11111111. 





Address-matching Vector Catch on 32-bit T32 
instruction at (vector-2) 


The core implements the following option: 
¢ Option 1: Does match. 





Address-matching Vector Catch on 32-bit T32 
instruction at (vector+2) 


The core implements the following option: 
¢ Option 1: Does match. 





Address-matching Vector Catch and Breakpoint 
on same instruction 


The core implements the following option: 
* Option 2: Report Breakpoint. 





Address match breakpoint with 
DBGBCRn_EL1.BAS=0000 


The core implements the following option: 
¢ Option 1: As if disabled. 





DBGWCRn_EL1.BAS specifies a non- 
contiguous set of bytes within a doubleword 


The core implements the following option: 
« A Watchpoint debug event is generated for each byte. 





A32 HLT instruction with condition code not 
AL 








The core implements the following option: 
* Option 3: Executed unconditionally. 
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A AArch32 UNPREDICTABLE Behaviors 
A.4 Arm®v8-A Debug UNPREDICTABLE behaviors 


Table A-1 Armv8-A Debug UNPREDICTABLE behaviors (continued) 





Scenario 


Behavior 





Execute instruction at a given EL when the 
corresponding EDECCR bit is 1 and Halting is 
allowed 


The core behaves as follows: 


* Generates debug event and Halt no later than the instruction following the next 
Context Synchronization operation (CSO) excluding ISB instruction. 





Unlinked Context matching and Address 
mismatch breakpoints taken to Abort mode 


The core implements the following option: 

* Option 2: A Prefetch Abort debug exception is generated. Because the 
breakpoint is configured to generate a breakpoint at PL1, the instruction at the 
Prefetch Abort vector generates a Vector Catch debug event. 





Note 


The debug event is subject to the same CONSTRAINED UNPREDICTABLE behavior, 
therefore the Breakpoint debug event is repeatedly generated an UNKNOWN number 
of times. 








Vector Catch on Data or Prefetch abort, and 
taken to Abort mode 


The core implements the following option: 


* Option 2: A Prefetch Abort debug exception is generated. If Vector Catch is 
enabled on the Prefetch Abort vector, this generates a Vector Catch debug event. 





Note 


The debug event is subject to the same CONSTRAINED UNPREDICTABLE behavior, 
therefore the Breakpoint debug event is repeatedly generated an UNKNOWN number 
of times. 








H> WN or H= 0 at Non-secure EL1 and ELO, 
including value read from PMCR_ELO.N 


The core implements: 

« Asimple implementation where all of HPMN[4:0] are implemented, and In 
Non-secure EL1 and ELO: 
— IfH>N then MEN. 
— IfH=0 then M=0. 





H>WN or H=0: value read back in 
MDCR_EL2.HPMN 


The core implements: 


« Asimple implementation where all of HPMN[4:0] are implemented and for 
reads of MDCR_EL2.HPMN, return H. 





P>M and P #31: reads and writes of PM 
XEVTYPER_ELO and PMXEVCNTR_ELO 


The core implements: 
« Asimple implementation where all of SEL[4:0] are implemented, and if P>M 
and P #31 then the register is RESO. 





P>M and P #31: value read in 
PMSELR_ELO.SEL 


The core implements: 
« Asimple implementation where all of SEL[4:0] are implemented, and if P>M 
and P #31 then the register is RESO. 





P = 31: reads and writes of PMXEVCNTR_ELO 


The core implements: 
° RESO. 





n> M: Direct access to PMEVCNTRn _ELO and 
PMEVTYPERn ELO 


The core implements: 
¢ Ifn>N, then the instruction is UNALLOCATED. 
¢ Otherwise ifn > M, then the register is RESO. 





Exiting Debug state while instruction issued 
through EDITR is in flight 








The core implements the following option: 
* Option 1: The instruction completes in Debug state before executing the restart. 
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A AArch32 UNPREDICTABLE Behaviors 
A.4 Arm®v8-A Debug UNPREDICTABLE behaviors 


Table A-1 Armv8-A Debug UNPREDICTABLE behaviors (continued) 





Scenario 


Behavior 





Using memory-access mode with a non-word- 
aligned address 


The core behaves as indicated in the sole Preference: 


* Does unaligned accesses, faulting if these are not permitted for the memory 


type. 





Access to memory-mapped registers mapped to 
Normal memory 


The core behaves as indicated in the sole Preference: 

¢ The access is generated, and accesses might be repeated, gathered, split, or 
resized, in accordance with the rules for Normal memory, meaning the effect is 
UNPREDICTABLE. 





Not word-sized accesses or (AArch64 only) 
doubleword-sized accesses 


The core behaves as indicated in the sole Preference: 


¢ Reads occur and return UNKNOWN data. 
« Writes set the accessed register(s) to UNKNOWN. 





External debug write to register that is being 
reset 


The core behaves as indicated in the sole Preference: 


¢ Takes reset value. 





Accessing reserved debug registers 


The core deviates from Preferred behavior because the hardware cost to decode 
some of these addresses in debug power domain is significantly high: 


Actual behavior: 

1. For reserved debug and Performance Monitors registers the response 
is CONSTRAINED UNPREDICTABLE Error or RESO, when any of the 
following error instead of preferred RESO for reserved debug registers 
@x@00-OxCFC and reserved PMU registers @x000-OxF OO: 


Off Core power domain is either completely off, or in a low- 
power state where the Core power domain registers 
cannot be accessed. 


DLK DoubleLockStatus() is TRUE, OS double-lock is 
locked, that is, EDPRSR.DLK is 1. 


OSLK OSLSR_EL1.OSLK is1, OS lock is locked. 
2. In addition, for reserved debug registers in the address ranges @x400 
to @x4FC and 0x80 to Ox8FC, the response is CONSTRAINED 


UNPREDICTABLE Error or RESO when the conditions in / do not apply 
and: 


EDAD AllowExternalDebugAccess() is FALSE, external 
debug access is disabled. 

3. For reserved Performance Monitor registers in the address ranges 
@x00 to OxOFC and Ox40O to Ox47C, the response is CONSTRAINED 
UNPREDICTABLE Error, or RESO when the conditions in / and 2 do not 
apply, and the following errors instead of preferred RESo for the these 
registers: 


EPMAD = AllowExternalPMUAccess() is FALSE (external 
Performance Monitors access is disabled). 





Clearing the clear-after-read EDPRSR bits 
when Core power domain is on, and 
DoubleLockStatus() is TRUE 








The core behaves as indicated in the sole Preference: 


¢ Bits are not cleared to zero. 








100442 0200 _00_en Copyright © 2016-2018 Arm Limited or its affiliates. All rights 


reserved. 
Non-Confidential 





Appx-A-803 


A AArch32 UNPREDICTABLE Behaviors 
A.5 Other UNPREDICTABLE behaviors 


A.5 Other UNPREDICTABLE behaviors 


This section describes other UNPREDICTABLE behaviors. 


Table A-2 Other UNPREDICTABLE behaviors 








Scenario Description 

CSSELR indicates a If CSSELR indicates a cache that is not implemented, then on a read of the CCSIDR the behavior is 
cache that is not CONSTRAINED UNPREDICTABLE, and can be one of the following: 

implemented. * The CCSIDR read is treated as NOP. 


¢ The CCSIDR read is UNDEFINED. 
¢« The CCSIDR read returns an UNKNOWN value (preferred). 





HDCR.HPMN is set to 0, | If HDCR.HPMN is set to 0, or to a value larger than PMCR.N, then the behavior in Non-secure ELO and 


or to a value larger than | EL1 is CONSTRAINED UNPREDICTABLE, and one of the following must happen: 
PMCR.N. 
¢ The number of counters accessible is an UNKNOWN non-zero value less than PMCR.N. 


¢ There is no access to any counters. 


For reads of HDCR.HPMN by EL2 or higher, if this field is set to 0 or to a value larger than PMCR.N, the 

core must return a CONSTRAINED UNPREDICTABLE Value that is one of: 

* PMCR.N. 

¢ The value that was written to HDCR.HPMN. 

¢ (The value that was written to HDCR.HPMN) modulo 2h, where h is the smallest number of bits 
required for a value in the range 0 to PMCR.N. 
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Appendix B 
Revisions 


This appendix describes the technical changes between released issues of this book. 


It contains the following section: 
¢ B.1 Revisions on page Appx-B-806. 
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B.1 Revisions 


This appendix describes the technical changes between released issues of this book. 


B Revisions 
B.1 Revisions 


Table B-1 Issue 0000-00 





Change 


Location | Affects 








First release | ~ 











Table B-2 Differences between issue 0000-00 and issue 0001-00 












































Change Location Affects 
Editorial changes 7 rp! 
Updated the product revision to r0p1 7 r0p1 
Minor updates in the components section A2.1 Components on page A2-34 r0p1 
Added a set of timer registers A2.4 About the Generic Timer on page A2-40 r0p1 
Updated the core dynamic retention mode A4.6.5 Core dynamic retention on page A4-55 r0pl 
Updated the section regarding configuring MMU | 45-5./ Configuring MMU accesses on page A5-67 r0p1 
accesses 

Updated the section regarding external aborts A5.6.3 External aborts on page A5-69 r0p1 
Updated the section regarding mis-programming A5.6.4 Mis-programming contiguous hints on page AS-69 r0p1 
contiguous hints 

Updated the section regarding conflict aborts A5.6.5 Conflict aborts on page A5-69 r0p1 
Updated the direct access to internal memory A6.6 Direct access to internal memory on page A6-84 r0p1 
Added information on outstanding simultaneous A7.1 About the L2 memory system on page A7-94 r0pl 
transactions supported 

Updated the support for memory types section | 47-3 Support for memory types on page A7-96 r0p1 





Updated the cluster registers tables 


B1.3 AArch32 implementation defined register summary on page B1-125, | r0p1 
B1.4 AArch32 registers by functional group on page B1-127, 

B2.3 AArch64 implementation defined register summary on page B2-294, 

B2.4 AArch64 registers by functional group on page B2-296 



































Updated the ACTLR_EL2 register B2.6 ACTLR_EL2, Auxiliary Control Register, EL2 on page B2-305 r0pl 
Updated the ACTLR_EL3 register B2.7 ACTLR_EL3, Auxiliary Control Register, EL3 on page B2-307 r0pl 
Updated the IFSR32_EL2 register B2.82 IFSR32_EL2, Instruction Fault Status Register, EL2 r0pl 
~ on page B2-424 

Updated the VDISR_EL2 register at EL1 using B2.105.3 VDISR_EL2 at EL] using AArch64 on page B2-457 r0pl 
AArch64 

Updated the ERROPFGCDNR register B3.7 ERROPFGCDNR, Error Pseudo Fault Generation Count Down r0pl 

Register on page B3-476 
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B Revisions 


B.1 Revisions 


Table B-2 Differences between issue 0000-00 and issue 0001-00 (continued) 

































































Change Location Affects 
Updated the ERROPFGCTLR, register B3.8 ERROPFGCTLR, Error Pseudo Fault Generation Control Register | r0p1 
on page B3-477 
Updated the PMU events C2.4 PMU events on page C2-567 r0p1 
Table B-3 Differences between issue 0001-00 and issue 0100-00 

Change Location Affects 
Editorial changes. 7 r1p0 
Updated the product revision to ; r1p0 
rl po. 
Updated product name. 7 rlp0 
Global terminology change from | ~ r1p0 
‘processor to 'core' for the 
product. 
Updated FCM to DSU. - t1p0 
Added ELA address size option. | 4/-3 Implementation options on page A1-28. rlp0 
Updated the encoding for the L2_ | 46.6.3 Encoding for the L2 TLB on page A6-87. rlp0 
TLB. 
Added CPU private registers. B1.3 AArch32 implementation defined register summary on page B1-125. rlp0 

B1.4 AArch32 registers by functional group on page B1-127. 

B1.21 CPUPCR, CPU Private Control Register on page B1-161. 

B1.22 CPUPMR, CPU Private Mask Register on page B1-163. 

B1.23 CPUPOR, CPU Private Operation Register on page B1-165. 

B1.24 CPUPSELR, CPU Private Selection Register on page B1-167. 

B2.3 AArch64 implementation defined register summary on page B2-294. 

B2.4 AArch64 registers by functional group on page B2-296. 

B2.31 CPUPCR_EL3, CPU Private Control Register, EL3 on page B2-343. 

B2.32 CPUPMR_EL3, CPU Private Mask Register, EL3 on page B2-345. 

B2.33 CPUPOR_EL3, CPU Private Operation Register, EL3 on page B2-347. 

B2.34 CPUPSELR_EL3, CPU Private Selection Register, EL3 on page B2-349. 
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B Revisions 
B.1 Revisions 


Table B-3 Differences between issue 0001-00 and issue 0100-00 (continued) 





Change 


Location Affects 





Added dot product instructions 
introduced in Armv8.4-A. 


Al.3 Implementation options on page A1-28. r1p0 
B1.2 AArch32 architectural system register summary on page B1-119. 

B1.4 AArch32 registers by functional group on page B1-127. 

B1.67 ID_ISAR6, Instruction Set Attribute Register 6 on page B1-230. 

B2.2 AArch64 architectural system register summary on page B2-287. 

B2.4 AArch64 registers by functional group on page B2-296. 


B2.73 ID_ISAR6_EL1, AArch32 Instruction Set Attribute Register 6, EL1 
on page B2-408. 


B2.58 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute Register 0, EL1 
on page B2-382. 





Updated the CPUECTLR and 
CPUECTLR_ELI registers. 


B1.20 CPUECTLR, CPU Extended Control Register on page B1-157. r1p0 
B2.30 CPUECTLR_EL1, CPU Extended Control Register, ELI on page B2-340. 























Updated the Use of R15 by A.1 Use of R15 by Instruction on page Appx-A-798. r1p0 
Instruction. 

Table B-4 Differences between issue 0100-00 and issue 0100-01 
Change Location Affects 
Updated company name to Arm : r1p0 





Updated the encoding for tag and data inthe L1 | 46.6./ Encoding for tag and data in the L1 data cache on page A6-85__| r1p0 


data cache 





instruction cache 


Updated the encoding for tag and data inthe L1 | 46.6.2 Encoding for tag and data in the L1 instruction cache rlp0 


on page A6-86 





Updated the transient hit behavior 


A7.3 Support for memory types on page A7-96 rlp0 





Updated the descriptions of bit[0] and bit[37] of | 8/-20 CPUECTLR, CPU Extended Control Register on page B1-157 rlp0 








the CPUECTLR register 

Updated the traps and enables in the B1.42 ERXPFGCDNR, Selected Error Pseudo Fault Generation Count |r1p0 
ERXPFGCDNR, ERXPFGCTLR, and Down Register on page B1-193, B1.43 ERXPFGCTLR, Selected Error 
ERXPFGER registers Pseudo Fault Generation Control Register on page B1-195, and 





B1.44 ERXPFGFR, Selected Pseudo Fault Generation Feature Register 
on page B1-196 








Table B-5 Differences between issue 0100-01 and issue 0200-00 














Change Location Affects 
Removed Dot Product instruction A1.3 Implementation options on page A1-28 r2p0 
support as an implementation option 

Added PBHA support as an A1.3 Implementation options on page A1-28 and A5.7 Page Based Hardware 12p0 
implementation option Attributes on page A5-71 
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B Revisions 


B.1 Revisions 


Table B-5 Differences between issue 0100-01 and issue 0200-00 (continued) 




































































Change Location Affects 
Updated transient memory region and | 49.4./ Memory system implementation on page A6-80 12p0 
non-temporal loads content 
Updated encoding for tag and data in A6.6.1 Encoding for tag and data in the LI data cache on page A6-85 12p0 
the LI data cache 
Updated main TLB RAM descriptor A6.6.4 Main TLB RAM descriptor fields on page A6-87 12p0 
fields 
Added AHTCR, ATTBCR, AVTCR B1.3 AArch32 implementation defined register summary on page B1-125, 12p0 
registers B1.4 AArch32 registers by functional group on page B1-127, B1.8 AHTCR, 
Auxiliary Hypervisor Translation Control Register on page B1-137, 
B1.13 ATTBCR, Auxiliary Translation Table Base Control Register 
on page B1-143, and B/.14 AVTCR, Auxiliary Virtualized Translation Control 
Register on page B1-145 
Updated MIDR register B1.4 AArch32 registers by functional group on page B1-127 and B1.76 MIDR, 12p0 
Main ID Register on page B1-247 
Updated CCSIDR encodings to include | 2/./5 CCSIDR, Cache Size ID Register on page B1-147 12p0 
256KB and 8MB L3 cache 
Added ATCR_ EL1, ATCR EL12, B2.3 AArch64 implementation defined register summary on page B2-294, 12p0 
ATCR EL2, ATCR EL3, and B2.4 AArch64 registers by functional group on page B2-296, B2.18 ATCR_EL1, 
AVTCR EL2 registers Auxiliary Translation Control Register, ELI on page B2-319, B2.19 ATCR_EL12, 
~ Alias to Auxiliary Translation Control Register EL1 on page B2-321, 
B2.20 ATCR_EL2, Auxiliary Translation Control Register, EL2 on page B2-322, 
B2.21 ATCR_EL3, Auxiliary Translation Control Register, EL3 on page B2-324, 
and B2.22 AVTCR_EL2, Auxiliary Virtualized Translation Control Register, EL2 
on page B2-326 
Updated MIDR_ELI register B2.4 AArch64 registers by functional group on page B2-296 and 12p0 
B2.89 MIDR_ELI, Main ID Register, EL] on page B2-433 
Updated ID AA64PFRO ELI register | 32.63 JD_AA64PFRO_ELI, AArch64 Processor Feature Register 0, EL1 12p0 
to include CSV2 and CSV3 on page B2-390 
Added ID_AA64PFR1 ELI register B2.64 ID_AA64PFRI_ELI, AArch64 Processor Feature Register 1, EL1 12p0 
on page B2-392 
Updated ID_PFRO_ ELI register to B2.79 ID_PFRO_EL1, AArch32 Processor Feature Register 0, EL1 12p0 
include CSV2 on page B2-419 
Added ID_PFR2_ELI register B2.81 ID_PFR2_EL1, AArch32 Processor Feature Register 2, EL1 12p0 
on page B2-423 
Updated EDPIDR2 register D3.14 EDPIDR3, External Debug Peripheral Identification Register 3 12p0 
on page D3-642 
Updated the PMU common events D4.3 PMCEID1, Performance Monitors Common Event Identification Register 1 | r2p0 
on page D4-654 
Updated PMPIDR2 register D6.9 PMPIDR2, Performance Monitors Peripheral Identification Register 2 12p0 
on page D6-685 
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